Cloudanix VulnDB

CVE-2026-98338

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing issue in Linux wireless networking code can cause errors when devices join certain ad-hoc networks while scans are happening at the same time.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition in cfg80211 IBSS event handling allows a BSS entry lookup to fail when a concurrent NL80211_SCAN_FLAG_FLUSH scan removes the entry after BSSID/channel recording but before event processing, triggering a warning at __cfg80211_ibss_joined.

Why it matters to the business

Wireless IBSS networks may experience intermittent kernel warnings or instability during join operations when scans occur, potentially disrupting ad-hoc connectivity in Linux environments.

How an attack unfolds

An attacker with local or network-adjacent access triggers rapid IBSS joins while issuing flush scans to race the BSS entry removal, causing the event workqueue to dereference a null BSS pointer.

How to fix it

Update to a kernel containing the referenced fix that performs early BSS lookup and holds a reference during IBSS joined event processing.

How to confirm the fix worked

Confirm the patch is applied by inspecting net/wireless/ibss.c for the refcounted BSS handling in __cfg80211_ibss_joined and test IBSS joins under concurrent flush scans without warnings.

Typical attack path

  1. Initiate IBSS join via cfg80211
  2. Concurrently issue scan with NL80211_SCAN_FLAG_FLUSH
  3. BSS entry is removed before event work processes the join
  4. Kernel hits warning path in ibss.c event handling

How to detect it

Review kernel logs for WARNING messages referencing net/wireless/ibss.c and __cfg80211_ibss_joined during IBSS join events; correlate with cfg80211_event_work activity.

What your security team should do

  • Prioritize kernel updates for systems using IBSS wireless mode
  • Monitor for cfg80211 warnings in kernel logs on affected kernels
  • Disable IBSS mode where not required until patched

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: ibss: ref BSS entry for joined event When the IBSS is joined, we only record the BSSID/channel in the event and look up the BSS entry when processing it. However, that's racy, e.g. a new scan with NL80211_SCAN_FLAG_FLUSH can remove it, causing a warning in the event work: !bss WARNING: net/wireless/ibss.c:37 at __cfg80211_ibss_joined+0x3d3/0x440 Workqueue: cfg80211 cfg80211_event_work cfg80211_process_wdev_events+0x39f/0x5b0 net/wireless/util.c:1144 cfg80211_process_rdev_events+0xa1/0x110 net/wireless/util.c:1179 cfg80211_event_work+0x2f/0x40 net/wireless/core.c:393 Do the lookup early (the driver is expected to only join an IBSS that has a BSS entry) and keep a reference to it.

Affected packages

Ecosystem Package Introduced Fixed