Cloudanix VulnDB

CVE-2026-98325

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A wireless networking bug in Linux could waste memory or cause crashes when certain transmission errors occur, but it is hard for attackers to exploit.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Failure to initialize skb->cb[] early in mac80211 TX path leaves error handling in ieee80211_build_hdr() and ieee80211_skb_resize() unable to call ieee80211_free_txskb(), resulting in unreported SKB leaks or inconsistent freeing on header-build or resize failures.

Why it matters to the business

Linux systems using Wi-Fi may experience gradual memory exhaustion or kernel instability under specific wireless transmit error conditions, potentially requiring reboots and affecting network-dependent workloads; low exploitability reduces immediate urgency.

How an attack unfolds

An attacker within wireless range triggers crafted frame transmission scenarios that cause ieee80211_build_hdr() or resize failures; without early TX info setup the SKB is not properly freed or reported, allowing resource exhaustion or denial of service over repeated attempts.

How to fix it

Update the Linux kernel to a version containing commit 2c51457d930f and the follow-on change that initializes skb->cb[] before ieee80211_build_hdr(); rebuild and deploy the fixed kernel image across affected systems.

How to confirm the fix worked

Confirm the presence of the fix by inspecting mac80211 TX code for early skb->cb[] initialization and use of ieee80211_free_txskb() on build_hdr failure; test by forcing TX error paths and verifying SKBs are reported to userspace.

Typical attack path

  1. Establish proximity to target Linux Wi-Fi interface
  2. Induce repeated TX header build or SKB resize failures via malformed frames or channel conditions
  3. Trigger unhandled SKB paths leading to unreported leaks
  4. Repeat to accumulate memory pressure or crash

How to detect it

Review kernel logs for repeated mac80211 TX failure messages without corresponding SKB free or userspace reports; inspect slabinfo or kmemleak output for orphaned 80211 SKBs after wireless activity.

What your security team should do

  • Prioritize kernel updates on systems with active Wi-Fi interfaces
  • Monitor kernel memory usage and OOM events on wireless hosts
  • Apply the fix during the next maintenance window given low EPSS

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: set up the TX info early to fix failure paths The previous commit 2c51457d930f ("wifi: mac80211: free ack status frame on TX header build failure") cleaned up the leak, but still left the code a bit messy and the failed SKB didn't get reported to userspace. Fix this up by initialising skb->cb[] earlier, which allows using ieee80211_free_txskb() and therefore reports it for the failure in ieee80211_build_hdr(), and unifies the ieee80211_skb_resize() failure path with it.

Affected packages

Ecosystem Package Introduced Fixed