Cloudanix VulnDB

CVE-2026-98337

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's wireless code can cause Wi-Fi connections to fail or the system to log errors when the device tries to scan for networks and switch channels at the same time.

Exploitation
Other
Attacker needs
Local User
Complexity
Theoretical
Impact
Other
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition in mac80211 allows a pending ROC work item to be processed after a scan has started, violating the empty-ROC-list requirement and triggering a kernel warning in ieee80211_start_next_roc.

Why it matters to the business

Wireless networking on Linux systems can become unstable, leading to dropped connections or device resets during routine Wi-Fi scanning and off-channel operations.

How an attack unfolds

An attacker with local access or control over wireless events induces concurrent scan and ROC scheduling; the race lets the ROC work execute after the scan begins, hitting the offchannel assertion and producing a warning or follow-on failure.

How to fix it

Update the Linux kernel to a version containing the mac80211 fix that prevents ROC start during an active scan; apply the patch or newer distribution kernel as soon as it is available.

How to confirm the fix worked

Confirm the kernel version includes the commit that adds the scan-active check before ieee80211_start_next_roc; run wireless stress tests that interleave scans and ROC requests and verify absence of the offchannel warning.

Typical attack path

  1. Obtain local execution or wireless event control on a Linux system using mac80211
  2. Trigger or schedule a background scan
  3. Queue a ROC request before the scan completes
  4. Force the cfg80211_wiphy_work queue to process the ROC while the scan is active
  5. Observe the resulting warning and any subsequent offchannel state corruption

How to detect it

Search kernel logs for the exact warning string from net/mac80211/offchannel.c:404 and stack traces containing ieee80211_start_next_roc, __ieee80211_scan_completed, and cfg80211_wiphy_work; correlate with wireless interface activity around the same timestamp.

  • WARNING: net/mac80211/offchannel.c:404 at ieee80211_start_next_roc
  • Workqueue: events_unbound cfg80211_wiphy_work
  • Call Trace: __ieee80211_scan_completed net/mac80211/scan.c

What your security team should do

  • Prioritize kernel updates on all Wi-Fi-enabled Linux endpoints within the next maintenance window
  • Monitor for mac80211-related kernel warnings in system logs
  • Temporarily disable background scanning or ROC-dependent features if updates cannot be applied promptly

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't start a ROC while scanning The ROC work can be pending when a scan starts (which requires ROC list to be empty, but that's possible), and then a new ROC can be added to the list and the work will pick it up. Avoid starting that ROC if a scan made it between things, as otherwise we'll hit a warning later: WARNING: net/mac80211/offchannel.c:404 at ieee80211_start_next_roc+0x256/0x2d0 Workqueue: events_unbound cfg80211_wiphy_work Call Trace: __ieee80211_scan_completed+0x4fd/0xe40 net/mac80211/scan.c:537 ieee80211_scan_work+0x472/0x1ff0 net/mac80211/scan.c:1193 cfg80211_wiphy_work+0x410/0x570 net/wireless/core.c:513

Affected packages

Ecosystem Package Introduced Fixed