CVE-2026-98339 (GCVE-0-2026-98339)

Vulnerability from cvelistv5 – Published: 2026-10-06 08:46 – Updated: 2026-10-07 06:50
VLAI
Title
wifi: cfg80211: don't filter by BSS type when removing stale entries
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't filter by BSS type when removing stale entries When an assoc AP switches to a channel that already has a BSS entry, cfg80211_update_assoc_bss_entry() removes that entry before rehashing the real one, since the two would otherwise collide in the BSS rbtree. The lookup for that entry also required it to match the connection's BSS type, so an entry advertising e.g. the IBSS capability bit was left in place, and the following cfg80211_rehash_bss() then ran into it: WARN_ON(!cmp) Changing the type shouldn't really happen, but can be triggered by a rogue AP/device, so drop the check and remove any entries matching the comparison.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
Linux CNA under the mitre root
CNA scorecard D 54/100 over 6633 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 0afd425b1b64251f19b5d8d8b49bf56fefbc643f , < 6ef87a853327434ae1cd9c5a2c27a557fb4047fc (git)
Affected: 0afd425b1b64251f19b5d8d8b49bf56fefbc643f , < 1380ee3a202dbb9f8e8b3c3b87eb410450d57799 (git)
Affected: 0afd425b1b64251f19b5d8d8b49bf56fefbc643f , < fb445ec7480da5d2b82bf681e3b4313603722729 (git)
Affected: 0afd425b1b64251f19b5d8d8b49bf56fefbc643f , < 65fdb973bd905bc3f5cb045a04c1828f2d2a7e24 (git)
Affected: 0afd425b1b64251f19b5d8d8b49bf56fefbc643f , < 64e23a36d8f04811372365b44cfca325f8e0f4bb (git)
Affected: 0afd425b1b64251f19b5d8d8b49bf56fefbc643f , < 6d2fd26185678038ef2ea11dd4d2e6eccbf2dd25 (git)
Affected: 0afd425b1b64251f19b5d8d8b49bf56fefbc643f , < 0aa44982125c86b47961be5ac1c82eddab8080f3 (git)
Affected: 0afd425b1b64251f19b5d8d8b49bf56fefbc643f , < b377e1000d963e7182a987082b4b06580bd7ac84 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.4
Unaffected: 0 , < 5.4 (semver)
Unaffected: 5.10.271 , ≤ 5.10.* (semver)
Unaffected: 5.15.222 , ≤ 5.15.* (semver)
Unaffected: 6.1.189 , ≤ 6.1.* (semver)
Unaffected: 6.6.158 , ≤ 6.6.* (semver)
Unaffected: 6.12.112 , ≤ 6.12.* (semver)
Unaffected: 6.18.54 , ≤ 6.18.* (semver)
Unaffected: 7.2.8 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/scan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6ef87a853327434ae1cd9c5a2c27a557fb4047fc",
              "status": "affected",
              "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
              "versionType": "git"
            },
            {
              "lessThan": "1380ee3a202dbb9f8e8b3c3b87eb410450d57799",
              "status": "affected",
              "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
              "versionType": "git"
            },
            {
              "lessThan": "fb445ec7480da5d2b82bf681e3b4313603722729",
              "status": "affected",
              "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
              "versionType": "git"
            },
            {
              "lessThan": "65fdb973bd905bc3f5cb045a04c1828f2d2a7e24",
              "status": "affected",
              "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
              "versionType": "git"
            },
            {
              "lessThan": "64e23a36d8f04811372365b44cfca325f8e0f4bb",
              "status": "affected",
              "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
              "versionType": "git"
            },
            {
              "lessThan": "6d2fd26185678038ef2ea11dd4d2e6eccbf2dd25",
              "status": "affected",
              "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
              "versionType": "git"
            },
            {
              "lessThan": "0aa44982125c86b47961be5ac1c82eddab8080f3",
              "status": "affected",
              "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
              "versionType": "git"
            },
            {
              "lessThan": "b377e1000d963e7182a987082b4b06580bd7ac84",
              "status": "affected",
              "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/scan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.4"
            },
            {
              "lessThan": "5.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.271",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.222",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.54",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.8",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc4",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: don\u0027t filter by BSS type when removing stale entries\n\nWhen an assoc AP switches to a channel that already has a BSS entry,\ncfg80211_update_assoc_bss_entry() removes that entry before rehashing\nthe real one, since the two would otherwise collide in the BSS rbtree.\n\nThe lookup for that entry also required it to match the connection\u0027s BSS\ntype, so an entry advertising e.g. the IBSS capability bit was left in\nplace, and the following cfg80211_rehash_bss() then ran into it:\n\n  WARN_ON(!cmp)\n\nChanging the type shouldn\u0027t really happen, but can be triggered by a\nrogue AP/device, so drop the check and remove any entries matching\nthe comparison."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The bad state comes from received 802.11 frames: a beacon/probe response carrying the associated AP\u0027s BSSID+SSID with the IBSS capability bit on another channel, then a CSA beacon that leads to cfg80211_ch_switch_notify() -\u003e cfg80211_update_assoc_bss_entry(). The attacker must be in WiFi radio range.\nAC:L - The attacker produces every step: injecting the colliding scan entry, sending the CSA (beacons are unprotected without beacon protection), then a second CSA or going silent so connection loss calls cfg80211_unlink_bss(). cmp_bss() ignores capability, so the rb_insert_bss() collision always happens.\nPR:N - No credentials are needed. A rogue AP, or an attacker spoofing management beacons of the victim\u0027s AP, triggers mac80211 channel-switch processing and scan-entry creation before any authenticated data exchange.\nUI:N - The victim station only needs to be in its normal associated state. Beacon/CSA processing and the later beacon-loss unlink happen automatically, with no user action.\nS:U - The corruption is confined to cfg80211\u0027s BSS list and rbtree within the same kernel. There is no hypervisor or other security-authority boundary crossed.\nC:H - After the failed rehash the connected BSS has stale rbn pointers. A second CSA makes cfg80211_rehash_bss() rb_erase() that non-member node, rewriting live parent/child links so bss_tree can reference entries later freed on expiry. That is a use-after-free on every rb lookup triggered by a received beacon.\nI:H - The double rb_erase() of the stale cbss-\u003erbn and the list_del() leaving poisoned pointers on a still-referenced BSS corrupt kernel heap metadata (tree links, bss_entries). The resulting use-after-free of cfg80211_internal_bss objects is a write-capable memory-corruption primitive.\nA:H - After cfg80211_rehash_bss() list_del()s the connected BSS, beacon-loss handling calls cfg80211_unlink_bss() -\u003e __cfg80211_unlink_bss() -\u003e list_del_init() on LIST_POISON pointers and faults (oops/panic). WARN_ON(!cmp) also panics with panic_on_warn."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-07T06:50:08.023Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6ef87a853327434ae1cd9c5a2c27a557fb4047fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/1380ee3a202dbb9f8e8b3c3b87eb410450d57799"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb445ec7480da5d2b82bf681e3b4313603722729"
        },
        {
          "url": "https://git.kernel.org/stable/c/65fdb973bd905bc3f5cb045a04c1828f2d2a7e24"
        },
        {
          "url": "https://git.kernel.org/stable/c/64e23a36d8f04811372365b44cfca325f8e0f4bb"
        },
        {
          "url": "https://git.kernel.org/stable/c/6d2fd26185678038ef2ea11dd4d2e6eccbf2dd25"
        },
        {
          "url": "https://git.kernel.org/stable/c/0aa44982125c86b47961be5ac1c82eddab8080f3"
        },
        {
          "url": "https://git.kernel.org/stable/c/b377e1000d963e7182a987082b4b06580bd7ac84"
        }
      ],
      "title": "wifi: cfg80211: don\u0027t filter by BSS type when removing stale entries",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98339",
    "datePublished": "2026-10-06T08:46:29.998Z",
    "dateReserved": "2026-09-25T10:25:14.342Z",
    "dateUpdated": "2026-10-07T06:50:08.023Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-98339",
      "date": "2026-10-08",
      "epss": "0.00285",
      "percentile": "0.19276"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/wireless/scan.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "6ef87a853327434ae1cd9c5a2c27a557fb4047fc",
                    "status": "affected",
                    "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1380ee3a202dbb9f8e8b3c3b87eb410450d57799",
                    "status": "affected",
                    "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fb445ec7480da5d2b82bf681e3b4313603722729",
                    "status": "affected",
                    "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "65fdb973bd905bc3f5cb045a04c1828f2d2a7e24",
                    "status": "affected",
                    "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "64e23a36d8f04811372365b44cfca325f8e0f4bb",
                    "status": "affected",
                    "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6d2fd26185678038ef2ea11dd4d2e6eccbf2dd25",
                    "status": "affected",
                    "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0aa44982125c86b47961be5ac1c82eddab8080f3",
                    "status": "affected",
                    "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b377e1000d963e7182a987082b4b06580bd7ac84",
                    "status": "affected",
                    "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/wireless/scan.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.4"
                  },
                  {
                    "lessThan": "5.4",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.271",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.222",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.189",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.158",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.112",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.54",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc4",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: don\u0027t filter by BSS type when removing stale entries\n\nWhen an assoc AP switches to a channel that already has a BSS entry,\ncfg80211_update_assoc_bss_entry() removes that entry before rehashing\nthe real one, since the two would otherwise collide in the BSS rbtree.\n\nThe lookup for that entry also required it to match the connection\u0027s BSS\ntype, so an entry advertising e.g. the IBSS capability bit was left in\nplace, and the following cfg80211_rehash_bss() then ran into it:\n\n  WARN_ON(!cmp)\n\nChanging the type shouldn\u0027t really happen, but can be triggered by a\nrogue AP/device, so drop the check and remove any entries matching\nthe comparison."
          }
        ],
        "id": "CVE-2026-98339",
        "lastModified": "2026-10-07T07:17:09.540",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-10-06T09:18:26.560",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0aa44982125c86b47961be5ac1c82eddab8080f3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1380ee3a202dbb9f8e8b3c3b87eb410450d57799"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/64e23a36d8f04811372365b44cfca325f8e0f4bb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/65fdb973bd905bc3f5cb045a04c1828f2d2a7e24"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6d2fd26185678038ef2ea11dd4d2e6eccbf2dd25"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6ef87a853327434ae1cd9c5a2c27a557fb4047fc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b377e1000d963e7182a987082b4b06580bd7ac84"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fb445ec7480da5d2b82bf681e3b4313603722729"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-10-08T16:47:13Z",
      "cve": "CVE-2026-98339",
      "id": "CVE-2026-98339",
      "initial_release_date": "2026-10-08T16:47:13Z",
      "product_status:known_affected": "158",
      "product_status:known_not_affected": "189",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-98339",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-98339.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.