{"metadata": {"vulnerability": "CVE-2026-98406", "count": 19, "kinds": {"milestone": 7, "sighting": 1, "kev": 0, "other": 11}}, "data": [{"timestamp": "2026-09-25T10:25:14.347Z", "date_only": false, "value": "2026-09-25T10:25:14.347Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-98406", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-98406", "record": "UBUNTU-CVE-2026-98406", "field": "published"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-98406", "record": "UBUNTU-CVE-2026-98406", "field": "modified"}, {"timestamp": "2026-10-14T13:27:41.192Z", "date_only": false, "value": "2026-10-14T13:27:41.192Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-98406", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T14:17:51Z", "date_only": false, "value": "2026-10-14T14:17:51Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-9HW7-47P3-C6FJ", "record": "GHSA-9HW7-47P3-C6FJ", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-14T14:17:51.710Z", "date_only": false, "value": "2026-10-14T14:17:51.710", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-98406", "record": "FKIE_CVE-2026-98406", "field": "published"}, {"timestamp": "2026-10-14T15:32:20Z", "date_only": false, "value": "2026-10-14T15:32:20Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-9HW7-47P3-C6FJ", "record": "GHSA-9HW7-47P3-C6FJ", "field": "published"}, {"timestamp": "2026-10-14T15:32:20Z", "date_only": false, "value": "2026-10-14T15:32:20Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-9HW7-47P3-C6FJ", "record": "GHSA-9HW7-47P3-C6FJ", "field": "modified"}, {"timestamp": "2026-10-14T18:36:13.511Z", "date_only": false, "value": "2026-10-14T18:36:13.511468Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117440706744808785", "record": "CVE-2026-98406", "field": "creation_timestamp", "uuid": "741ec267-750b-44b1-b270-647cfda03be8", "content": "CVE-2026-98406 wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver In the Linux kernel, the following vulnerability has been resolved:\nwifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver\nieee80211_set_bitrate_mask() checks if the interface is running viaieee80211_sdata_running(), but it does not check if the interface isstill present in the driver.\nWhen sdata is running but IEEE80211_SDATA_IN_DRIVER is not set, thecall reaches drv_set_bitrate_mask() in driver-ops.h which hits\n  wlan1: Failed check-sdata-in-driver check, flags: 0x0  WARNING: net/mac80211/driver-ops.h:884 at drv_set_bitrate_mask\nSyzkaller triggers this via wext SIOCSIWRATE ioctl. The Call Trace showswext_ioctl_dispatch() in wext-core.c dispatching the ioctl, callingioctl_standard_call() for SIOCSIWRATE, which calls cfg80211_wext_siwrate()in wext-compat.c. That builds a bitrate mask and callsrdev_set_bitrate_mask() which ends up in ieee80211_set_bitrate_mask() incfg.c. The interface is marked running via SDATA_STATE_RUNNING butflags is 0, so check_sdata_in_driver() fails.\nWhen the interface is being torn down, or when wext ioctl is issuedduring interface bringup before drv_add_interface() sets IN_DRIVER, therunning check passes while IN_DRIVER is clear.\nCheck IEEE80211_SDATA_IN_DRIVER in ieee80211_set_bitrate_mask() beforecalling the driver, returning -ENETDOWN. This avoids the WARN_ONCE indriver-ops.h and matches other cfg.c operations that bail early when notin driver.\nThis change should be safe because wiphy mutex is held incfg80211_wext_siwrate() via guard(wiphy), and IN_DRIVER is set/clearedunder RTNL and wiphy paths in drv_add_interface() anddrv_remove_interface() in driver-ops.c, so the check is race-freeagainst driver add/remove. Returning -ENETDOWN is the same error othernot-running paths use and does not introduce new locking.\n[also add second syzbot report]\nhttps://www.cve.org/CVERecord?id=CVE-2026-98406https://git.kernel.org/stable/c/4ba86c44b2fcb1c3175caa2456b6d58f483446abhttps://git.kernel.org/stable/c/4095b66acae9893dd13deb39a4331651cb2f822bhttps://git.kernel.org/stable/c/c2cd9c44777cf97be3e35c10b7c2d8f59ebb9306https://git.kernel.org/stable/c/0d1700394e9f5d0bd9bebad8d5a50edf983f52fdhttps://git.kernel.org/stable/c/7978dda63d2b109ea9c3f7a096cd1aac6542cd54https://git.kernel.org/stable/c/432c8532d5ccc2af77da43ed6ef1c80495a4efe8https://git.kernel.org/stable/c/c4ee5685af444024e6222ce29f6ed36adc44ffc3https://git.kernel.org/stable/c/da2ca406f45a6e21760243152ed8d2e8e72915c2#kernel #Linux#CVE_2026_98406#bot", "url": "https://infosec.exchange/users/cve/statuses/117440706744808785"}, {"timestamp": "2026-10-16T01:04:22Z", "date_only": false, "value": "2026-10-16T01:04:22.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98406", "record": "MSRC_CVE-2026-98406", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-16T01:04:22Z", "date_only": false, "value": "2026-10-16T01:04:22.000Z", "kind": "other", "label": "Date", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98406", "record": "MSRC_CVE-2026-98406", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2026-10-16T01:04:22Z", "date_only": false, "value": "2026-10-16T01:04:22.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98406", "record": "MSRC_CVE-2026-98406", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-10-16T01:04:22Z", "date_only": false, "value": "2026-10-16T01:04:22.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98406", "record": "MSRC_CVE-2026-98406", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-16T07:00:53.891Z", "date_only": false, "value": "2026-10-16T07:00:53.891Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-98406", "record": "MSRC_CVE-2026-98406", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-17T06:05:38.558Z", "date_only": false, "value": "2026-10-17T06:05:38.558142Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-98406", "record": "BELL-CVE-2026-98406", "field": "published"}, {"timestamp": "2026-10-17T06:20:29.291Z", "date_only": false, "value": "2026-10-17T06:20:29.291958Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-98406", "record": "BELL-CVE-2026-98406", "field": "modified"}, {"timestamp": "2026-10-19T09:18:59.519Z", "date_only": false, "value": "2026-10-19T09:18:59.519Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-98406", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-19T09:18:59.519Z", "date_only": false, "value": "2026-10-19T09:18:59.519Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-98406", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-19T10:18:45.657Z", "date_only": false, "value": "2026-10-19T10:18:45.657", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-98406", "record": "FKIE_CVE-2026-98406", "field": "lastModified"}]}