Cloudanix VulnDB

CVE-2026-98329

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

Wireless networking code in Linux could let certain crafted network signals cause internal system warnings if not properly checked.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Improper input validation in mac80211 allows monitor interface frame injection with radiotap bandwidth requests exceeding the operational channel context bandwidth, triggering a WARN_ON in hwsim instead of silently dropping the frame.

Why it matters to the business

Wireless Linux systems may experience unexpected kernel warnings or logging noise from crafted wireless traffic; low likelihood of widespread operational disruption given the narrow conditions and lack of active exploitation.

How an attack unfolds

An attacker with access to a monitor interface crafts 802.11 frames containing radiotap headers specifying excessive bandwidth, causing mac80211 to forward them to the driver and hit the hwsim width check without prior validation.

How to fix it

Update to a Linux kernel containing the mac80211 fix that drops frames with excessive requested bandwidth; no specific fixed versions provided in advisory.

How to confirm the fix worked

Confirm kernel source includes the check that rejects frames where hwsim_get_chanwidth(bw) exceeds hwsim_get_chanwidth(confbw); test by attempting injection of over-width frames and verifying they are dropped without warning.

Typical attack path

  1. Obtain monitor mode access on a compatible wireless interface
  2. Construct radiotap header requesting bandwidth wider than current chanctx
  3. Inject the frame via the monitor interface
  4. Trigger WARN_ON in hwsim when bandwidth check fails

How to detect it

Search kernel logs and dmesg for the hwsim bandwidth WARN_ON string; inspect wireless monitor interface traffic for anomalous radiotap bandwidth fields.

What your security team should do

  • Apply the mac80211 patch or newer kernel as soon as available for wireless-enabled systems
  • Monitor kernel logs for the specific hwsim WARN_ON pattern on exposed devices
  • Limit monitor interface usage to trusted processes only

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't allow injecting frames wider than the chanctx Frames injected on a monitor interface can carry a radiotap field requesting a bandwidth, which mac80211 passes down to the driver regardless of the the actual operational bandwidth. If the bandwidth requested is too wide, that triggers a warning in hwsim: WARN_ON(hwsim_get_chanwidth(bw) > hwsim_get_chanwidth(confbw)) Drop such frames entirely instead since they cannot be sent.

Affected packages

Ecosystem Package Introduced Fixed