Cloudanix VulnDB

CVE-2026-98340

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A bug in the Linux wireless code could cause internal warnings or instability when certain Wi-Fi networks send both probe responses and hidden beacons.

Exploitation
Adjacent Network
Attacker needs
None
Complexity
Theoretical
Impact
Other
Component
OS kernel
Class
Other
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The cfg80211 BSS update logic incorrectly groups probe-response entries that lack beacon IEs, violating the invariant that only beacon-backed entries participate in hidden-BSS grouping; later arrival of a hidden-SSID beacon triggers WARN_ON_ONCE checks in cfg80211_combine_bsses.

Why it matters to the business

Linux Wi-Fi stacks may emit kernel warnings or experience unexpected behavior when processing certain probe responses and beacons, potentially affecting stability of wireless connectivity on affected kernels.

How an attack unfolds

An attacker-controlled access point sends a probe response for a BSSID that already has a hidden-SSID probe-response entry; subsequent transmission of a hidden-SSID beacon causes the kernel to attempt an illegal grouping and hit the internal assertions.

How to fix it

Apply the upstream fix that restricts grouping of hidden BSSes to entries that already possess beacon IEs; rebuild and deploy the corrected kernel image on all affected Linux systems.

How to confirm the fix worked

Confirm the patch is present by inspecting the cfg80211 source for the conditional check ensuring a beacon entry exists before grouping; exercise hidden-SSID BSS scenarios in a test environment and verify absence of the two WARN_ON_ONCE statements.

Typical attack path

  1. Attacker AP transmits probe response with SSID for a BSSID already represented by a hidden probe-response entry
  2. cfg80211_bss_update links the two probe-response entries into a group without beacon elements
  3. Attacker later sends a beacon frame with hidden SSID for the same BSSID/channel
  4. cfg80211_combine_bsses walks hidden_list and encounters pre-grouped entries, firing WARN_ON_ONCE

How to detect it

Search kernel logs and dmesg for the strings "hidden_beacon_bss" and "hidden_list" together with cfg80211_combine_bsses stack traces; correlate with wireless interface state changes around the time of the warnings.

  • WARN_ON_ONCE(bss->pub.hidden_beacon_bss)
  • WARN_ON_ONCE(!list_empty(&bss->hidden_list))
  • cfg80211_combine_bsses

What your security team should do

  • Prioritize kernel updates containing the cfg80211 BSS grouping fix on all Wi-Fi-enabled Linux hosts
  • Monitor kernel logs for the hidden_beacon_bss and hidden_list WARN_ON strings until patches are deployed
  • Limit exposure by disabling unnecessary probe-response processing or hidden-SSID networks where feasible

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: only group hidden BSSes with beacon entries When a probe response for an unknown BSS comes in, __cfg80211_bss_update() looks for an existing entry with the same BSSID and a hidden (zero-length or NUL-filled) SSID, and if it finds one it groups them, using the beacon IEs from the existing entry. But that could find another entry without a beacon, if it was also from a probe response (with SSID), so there's a group without beacon elements. If a beacon with a hidden SSID for that BSSID arrives later, cfg80211_combine_bsses() goes looking for the probe response entries that belong to it - i.e. entries with the same BSSID and channel that have no beacon IEs - and finds those two. They are already grouped with each other, so it hits its WARN_ON_ONCE(bss->pub.hidden_beacon_bss) WARN_ON_ONCE(!list_empty(&bss->hidden_list)) which are there because an entry without beacon elements is not supposed to be part of a group yet. Only combine entries when a beacon was already received, ones that are kept separate will be combined when a beacon arrives.

Affected packages

Ecosystem Package Introduced Fixed