Cloudanix VulnDB

CVE-2026-98339

High · 8.8

CVSS

8.8

EPSS

0.3%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in Linux wireless handling lets a nearby attacker send signals that can make the system unstable or crash during normal Wi-Fi connections.

Exploitation
Adjacent Network
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The cfg80211 BSS lookup in cfg80211_update_assoc_bss_entry() incorrectly filtered on BSS type, allowing stale entries with mismatched capability bits (such as IBSS) to remain in the rbtree; subsequent cfg80211_rehash_bss() then hits a WARN_ON due to the collision.

Why it matters to the business

Wireless network instability or crashes on Linux systems handling association updates can interrupt connectivity for users and services relying on Wi-Fi, with elevated urgency for organizations running recent kernels exposed to wireless environments.

How an attack unfolds

An attacker operating a rogue AP or device advertises an association that triggers channel switch logic; the kernel's type-filtered stale-entry removal leaves a colliding BSS, causing the rehash to fail and surface the warning condition that a malicious actor can repeatedly provoke.

How to fix it

Apply the upstream kernel commit that removes the BSS-type filter from the stale-entry lookup and update to the corresponding fixed kernel release for all affected distributions.

How to confirm the fix worked

Confirm the fix by inspecting the cfg80211_update_assoc_bss_entry source for absence of the BSS-type comparison in the stale-entry removal path and verify the change appears in the running kernel's git history or package changelog.

Typical attack path

  1. Attacker positions a rogue AP or device near the target Linux system
  2. Rogue device initiates or spoofs an association that causes cfg80211_update_assoc_bss_entry to run
  3. Stale BSS entry with mismatched type (e.g., IBSS bit) evades removal
  4. cfg80211_rehash_bss encounters the collision and triggers WARN_ON
  5. Repeated triggers lead to logging, potential stability issues, or crash

How to detect it

Search kernel logs for the specific WARN_ON string triggered by cfg80211_rehash_bss collisions and correlate with wireless interface association events around the time of the rogue AP activity.

What your security team should do

  • Prioritize kernel updates on all Linux wireless endpoints within the next patch cycle
  • Monitor wireless association logs for repeated WARN_ON messages related to BSS rehash
  • Limit exposure by disabling unnecessary IBSS/ad-hoc modes where operationally feasible

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't filter by BSS type when removing stale entries When an assoc AP switches to a channel that already has a BSS entry, cfg80211_update_assoc_bss_entry() removes that entry before rehashing the real one, since the two would otherwise collide in the BSS rbtree. The lookup for that entry also required it to match the connection's BSS type, so an entry advertising e.g. the IBSS capability bit was left in place, and the following cfg80211_rehash_bss() then ran into it: WARN_ON(!cmp) Changing the type shouldn't really happen, but can be triggered by a rogue AP/device, so drop the check and remove any entries matching the comparison.

Affected packages

Ecosystem Package Introduced Fixed