Unknown

CVE-2026-98406 — wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver ieee80211_set_bitrate_mask() checks if the interface is running via ieee80211_sdata_running(), but it does not check if the interface is still present in the driver. When sdata is running but IEEE80211_SDATA_IN_DRIVER is not set, the call reaches drv_set_bitrate_mask() in driver-ops.h which hits wlan1: Failed check-sdata-in-driver check, flags: 0x0 WARNING: net/mac80211/driver-ops.h:884 at drv_set_bitrate_mask Syzkaller triggers this via wext SIOCSIWRATE ioctl. The Call Trace shows wext_ioctl_dispatch() in wext-core.c dispatching the ioctl, calling ioctl_standard_call() for SIOCSIWRATE, which calls cfg80211_wext_siwrate() in wext-compat.c. That builds a bitrate mask and calls rdev_set_bitrate_mask() which ends up in ieee80211_set_bitrate_mask() in cfg.c. The interface is marked running via SDATA_STATE_RUNNING but flags is 0, so check_sdata_in_driver() fails. When the interface is being torn down, or when wext ioctl is issued during interface bringup before drv_add_interface() sets IN_DRIVER, the running check passes while IN_DRIVER is clear. Check IEEE80211_SDATA_IN_DRIVER in ieee80211_set_bitrate_mask() before calling the driver, returning -ENETDOWN. This avoids the WARN_ONCE in driver-ops.h and matches other cfg.c operations that bail early when not in driver. This change should be safe because wiphy mutex is held in cfg80211_wext_siwrate() via guard(wiphy), and IN_DRIVER is set/cleared under RTNL and wiphy paths in drv_add_interface() and drv_remove_interface() in driver-ops.c, so the check is race-free against driver add/remove. Returning -ENETDOWN is the same error other not-running paths use and does not introduce new locking. [also add second syzbot report]

Published Oct 14, 2026 · Updated Oct 14, 2026 · Sources: NIST National Vulnerability Database, CVE Program (cve.org) e CISA ADP · CNA: Linux

Low

Who exploits it and how urgent it is

A 0–100 score combining confirmed exploitation, ransomware and APT use, public exploits, EPSS and severity.

No exploitation signal in the sources consulted so far.

How the score was calculated

No scoring signals.

The score orders the patch queue; it does not replace your asset context (internet exposure, criticality, compensating controls).

Triage

Is it exploited, how likely is exploitation, what does it touch, and how severe do the sources call it.

Exploitation

Not confirmed

Not in CISA KEV — an absence of record, not proof it is unexploited.

EPSS FIRST

—

No EPSS score.

Affects

Linux

CVSS base

—

Score not published yet.

Remediation

Fixes and mitigations documented by the sources — linked to the original advisory.

No fix documented by the sources we poll. That does not mean none exists: check the vendor advisory.

First 24 hours

Ordered from the record’s own fields — exposure first, because you cannot patch what you have not found. A rule-generated starting point.

Identify exposed assets running the affected vendor/product/version combinations (Linux Linux).
No fix documented in the sources: reduce exposure and monitor the vendor advisory.
Search available logs for exploit probes, errors and authentication anomalies.

Affected scope

Vendor, product and versions as the sources word them.

Vendor	Product	Versions	Status	Source
Linux	Linux	≥ 554a43d5e77e8256aa9685ffd19ad555e6f77979 and < 4ba86c44b2fcb1c3175caa2456b6d58f483446ab≥ 554a43d5e77e8256aa9685ffd19ad555e6f77979 and < 4095b66acae9893dd13deb39a4331651cb2f822b≥ 554a43d5e77e8256aa9685ffd19ad555e6f77979 and < c2cd9c44777cf97be3e35c10b7c2d8f59ebb9306≥ 554a43d5e77e8256aa9685ffd19ad555e6f77979 and < 0d1700394e9f5d0bd9bebad8d5a50edf983f52fd≥ 554a43d5e77e8256aa9685ffd19ad555e6f77979 and < 7978dda63d2b109ea9c3f7a096cd1aac6542cd54≥ 554a43d5e77e8256aa9685ffd19ad555e6f77979 and < 432c8532d5ccc2af77da43ed6ef1c80495a4efe8≥ 554a43d5e77e8256aa9685ffd19ad555e6f77979 and < c4ee5685af444024e6222ce29f6ed36adc44ffc3≥ 554a43d5e77e8256aa9685ffd19ad555e6f77979 and < da2ca406f45a6e21760243152ed8d2e8e72915c2 and 1 more version 3.5	Vulnerable	CVE Program (cve.org) e CISA ADP

Detection

Read off the CVSS vector and the weakness class. Starting points, not tested rules.

Not enough vector or weakness data: use the affected application’s logs as a starting point.

application logs

Timeline

What happened to this CVE, newest first.

2026
Record published
Oct 14, 2026
Affected products added · linux/linux
Oct 14, 2026 · CVE Program (cve.org) e CISA ADP
Source status changed · → Received
Oct 14, 2026 · NIST National Vulnerability Database
Record created in this database
Oct 14, 2026 · Alertas do Telegram
CVE published
Oct 14, 2026 · Linux

Source activity

Repeated readings are counted rather than listed.

1× References added · Oct 14, 2026 – Oct 14, 2026
1× Official description updated · Oct 14, 2026 – Oct 14, 2026

References

8 on the record

git.kernel.org/stable/c/0d1700394e9f5d0bd9bebad8d5a50edf983f52fd
NIST National Vulnerability Database
git.kernel.org/stable/c/da2ca406f45a6e21760243152ed8d2e8e72915c2
NIST National Vulnerability Database
git.kernel.org/stable/c/4095b66acae9893dd13deb39a4331651cb2f822b
NIST National Vulnerability Database
git.kernel.org/stable/c/432c8532d5ccc2af77da43ed6ef1c80495a4efe8
NIST National Vulnerability Database
git.kernel.org/stable/c/c2cd9c44777cf97be3e35c10b7c2d8f59ebb9306
NIST National Vulnerability Database
git.kernel.org/stable/c/4ba86c44b2fcb1c3175caa2456b6d58f483446ab
NIST National Vulnerability Database
git.kernel.org/stable/c/c4ee5685af444024e6222ce29f6ed36adc44ffc3
NIST National Vulnerability Database
git.kernel.org/stable/c/7978dda63d2b109ea9c3f7a096cd1aac6542cd54
NIST National Vulnerability Database

Elsewhere on this site

Linux
every CVE for this vendor

Related CVEs (same products)

Critical CVE-2026-99999 ipv4: validate checksum_start before completing checksum 11h
Unknown CVE-2026-98432 ipv4: free inet_opt and ireq_opt after an RCU grace period 11h
Unknown CVE-2026-98424 wifi: cfg80211: undo netns switch if renaming the wiphy fails 1d
Unknown CVE-2026-98425 wifi: mac80211: don't warn when an IBSS has no channel to scan 1d
Unknown CVE-2026-98426 wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path 1d
Unknown CVE-2026-98427 net/sched: codel: bound the dropping loop per dequeue call 1d

Not in any source we poll

Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.

No CVSS score published by NVD, the CNA, CISA or GitHub so far.
No FIRST EPSS score.
No fixed version, patch or mitigation documented.
No CISA SSVC assessment.
No CWE classification.
No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
No exploit packet captures, log samples, or incident case IDs supplied.

Answered from this record

Text assembled only from the fields above — no additional claims.

What should defenders know first?

CVE-2026-98406 is "wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver", rated Unknown. It affects Linux (Linux); versions are in the scope table. It is not in CISA KEV, which does not rule out exploitation. First verify whether exposed or business-critical assets run the affected versions, apply vendor fixes or mitigations, and preserve logs for review.

Comments

Moderated technical discussion. Read the community guidelines.

No comments yet.