Cloudanix VulnDB

CVE-2026-98332

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A wireless networking bug in Linux could cause confusing system warnings or instability when handling certain device connections.

Exploitation
Other
Attacker needs
Local User
Complexity
Theoretical
Impact
Other
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The ieee80211_tdls_oper function lacks validation that the target station is a TDLS peer, allowing operations on the AP station that later trigger warnings or state confusion when the AP station is removed.

Why it matters to the business

Wireless Linux systems may experience log spam, unexpected warnings, or instability in managed Wi-Fi connections, increasing support burden for device fleets that rely on TDLS.

How an attack unfolds

An attacker with local or network access to a Linux wireless device can trigger TDLS operation paths that inadvertently act on the AP station instead of a legitimate peer, causing the kernel to mishandle station removal and produce warnings at a later time.

How to fix it

Update to a Linux kernel version that includes the upstream fix ensuring ieee80211_tdls_oper only acts on verified TDLS peers. Rebuild and deploy any custom kernels or distributions incorporating the corrected mac80211 code.

How to confirm the fix worked

Confirm the presence of the station-type check before calling TDLS operations in the mac80211 source; test by exercising TDLS paths and verifying absence of AP-station confusion warnings in dmesg or kernel logs.

Typical attack path

  1. Obtain local or adjacent network access to a Linux system using mac80211 wireless drivers
  2. Trigger TDLS-related station operations that reach ieee80211_tdls_oper without peer-type validation
  3. Cause the kernel to treat the AP station as a TDLS peer, leading to warnings on station removal
  4. Observe repeated warnings or potential follow-on instability during normal AP station lifecycle events

How to detect it

Search kernel logs and dmesg for warnings generated during station removal after TDLS operations; look for references to AP station being mishandled in mac80211 context.

What your security team should do

  • Prioritize kernel updates for all Linux wireless endpoints within standard patch cycles
  • Monitor kernel logs for TDLS-related station warnings as an interim detection signal
  • Review wireless driver configurations to limit unnecessary TDLS usage where feasible

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: only operate on TDLS peers in the TDLS code ieee80211_tdls_oper() can operate on the AP station, which then yields various warnings when the AP station is removed then or at a later point in time after being confused for a TDLS peer. Always check that the station is a TDLS peer.

Affected packages

Ecosystem Package Introduced Fixed