Cloudanix VulnDB

CVE-2026-98183

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux wireless mesh networking code could let attackers send specially crafted network messages that read a little bit of memory they should not, potentially causing crashes on affected devices.

Exploitation
Adjacent Network
Attacker needs
None
Complexity
Low
Impact
Data Exposure
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds one-byte read occurs when ieee80211_mesh_preq_size_ok() and ieee80211_mesh_hwmp_preq_get_bottom() access PREQ bottom fields before validating the element contains at least the fixed header, allowing a read past the declared payload on an empty PREQ element.

Why it matters to the business

Wireless mesh networking on Linux systems may experience crashes, unexpected reboots, or limited memory disclosure when processing malformed management frames, affecting availability of Wi-Fi mesh deployments and increasing operational overhead for patching kernel drivers.

How an attack unfolds

An attacker crafts an empty Path Request element inside an 802.11 mesh management frame and transmits it to a vulnerable Linux device participating in a mesh network; the kernel parses the element without first confirming minimum size, triggering the out-of-bounds read during flag inspection for optional address extensions.

How to fix it

Apply the upstream kernel patch that relocates the bottom-fields helper call after both size checks; rebuild and deploy the corrected mac80211 module or upgrade to a Linux distribution kernel containing the fix.

How to confirm the fix worked

Confirm the patched source contains the reordered size checks before the ieee80211_mesh_hwmp_preq_get_bottom() invocation; test by replaying an empty PREQ element and verifying no out-of-bounds access occurs under kernel memory debugging.

Typical attack path

  1. Join or observe an 802.11s mesh network
  2. Transmit a minimal or zero-length PREQ information element in a mesh path request frame
  3. Trigger ieee80211_mesh_preq_size_ok() followed by ieee80211_mesh_hwmp_preq_get_bottom() on the undersized element
  4. Cause one-byte read beyond element bounds leading to crash or information leak

How to detect it

Review kernel logs for page faults or oops messages during 802.11 mesh frame processing; inspect wireless packet captures for PREQ elements whose length is smaller than the fixed header size.

What your security team should do

  • Prioritize kernel updates for systems running mac80211 mesh on wireless interfaces
  • Monitor upstream stable kernel releases and distribution security advisories for the corrected mac80211 code
  • Temporarily disable 802.11s mesh functionality where feasible until patches are applied

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: avoid out-of-bounds read for empty PREQ elements ieee80211_mesh_preq_size_ok() derives the location of the PREQ bottom fields before checking whether the element contains even the fixed header. ieee80211_mesh_hwmp_preq_get_bottom() reads the flags byte to account for the optional Address Extension field. Consequently, an empty PREQ element causes a one-byte read beyond its declared payload. Move the helper call after both size checks, so the bottom fields are only accessed when they are present.

Affected packages

Ecosystem Package Introduced Fixed