Cloudanix VulnDB

CVE-2026-98328

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A math error in Linux wireless networking code can stop proper scanning on newer WiFi frequencies and cause connection problems.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Theoretical
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Insufficient accounting for the HE 6 GHz Band Capability element size in scan_ies_len calculation within mac80211 when 6 GHz is supported, allowing probe request element construction to fail and trigger WARN_ON in __ieee80211_start_scan.

Why it matters to the business

WiFi scanning instability or warnings may occur on Linux systems supporting 6 GHz bands, potentially disrupting network discovery and connectivity for modern wireless hardware with no widespread exploitation observed.

How an attack unfolds

No active exploitation or threat actor campaigns are associated; the condition is triggered internally during normal 6 GHz capable device scanning rather than by external attack.

How to fix it

Apply the kernel patch that adds the HE 6 GHz capability size to scan_ies_len; upgrade to a fixed mainline or distribution kernel containing this mac80211 change.

How to confirm the fix worked

Confirm absence of WARN_ON in __ieee80211_start_scan during 6 GHz scans after kernel update; verify scan_ies_len includes the additional element size in source or runtime traces.

Typical attack path

  1. Enable 6 GHz support on Linux WiFi device
  2. Initiate probe request scan via mac80211
  3. Trigger element length miscalculation leading to build failure

How to detect it

Inspect kernel logs for warnings originating from __ieee80211_start_scan or probe request element construction failures on 6 GHz capable hardware.

What your security team should do

  • Prioritize kernel updates for systems with 6 GHz WiFi hardware
  • Review mac80211 scan behavior in logs on affected devices
  • Track upstream Linux wireless subsystem releases for similar length calculation fixes

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: add HE 6 GHz capability in the scan elems len The HE 6 GHz Band Capability element is in the probe request for every band if 6 GHz is supported, so add the size to scan_ies_len. Otherwise, building probe request elements can fail, triggering the WARN_ON in __ieee80211_start_scan().

Affected packages

Ecosystem Package Introduced Fixed