Cloudanix VulnDB

CVE-2026-98421

None

CVSS

—

EPSS

0.2%

Published

Oct 14, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux wireless code could let certain network messages create unnecessary system warnings that might affect Wi-Fi stability.

Exploitation
Adjacent Network
Attacker needs
None
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw permits a TDLS setup confirm frame to be processed for a non-existent peer station, triggering a kernel warning (WARN_ON_ONCE) during frame construction in mac80211.

Why it matters to the business

Wireless drivers may log warnings or experience instability during TDLS operations on affected Linux systems, potentially affecting Wi-Fi connectivity reliability in enterprise or embedded environments.

How an attack unfolds

An attacker within range sends a crafted WLAN_TDLS_SETUP_CONFIRM frame referencing a station that has not been established; the missing validation allows the frame to reach frame-building code that assumes a valid station exists, surfacing the warning.

How to fix it

Update to a Linux kernel containing the fix that adds an explicit station existence check before accepting WLAN_TDLS_SETUP_CONFIRM frames and routes such frames through ieee80211_tdls_prep_mgmt_packet only for valid peers.

How to confirm the fix worked

Confirm the patch is present by inspecting the mac80211 TDLS handling code for the station-existence guard before processing setup confirm frames; test by injecting a confirm frame for a non-existent station and verifying no warning is emitted.

Typical attack path

  1. Attacker associates or observes a target AP and identifies a client supporting TDLS.
  2. Attacker transmits a TDLS setup confirm frame with a fabricated peer address that does not correspond to any established station.
  3. mac80211 processes the frame without checking for the peer station existence.
  4. The warning is emitted when attempting to build the management frame.

How to detect it

Search kernel logs for repeated occurrences of the WARN_ON_ONCE message tied to TDLS management frame construction; review wireless packet captures for unexpected TDLS setup confirm frames directed at unknown stations.

What your security team should do

  • Apply the upstream mac80211 TDLS validation patch as soon as a distribution kernel update is available.
  • Monitor wireless driver logs for repeated WARN_ON occurrences related to TDLS frame construction.
  • Disable TDLS on systems where the feature is not required until patches are deployed.

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: require a peer station for TDLS setup confirm It's nonsense for the setup confirm to go to station that doesn't even exist, and it hits a warning when building the frame: WARN_ON_ONCE(!sta || !ap_sta) Only accept WLAN_TDLS_SETUP_CONFIRM when the station is already there as a TDLS station. Need to copy the call to ieee80211_tdls_prep_mgmt_packet() since the existing WLAN_TDLS_DISCOVERY_REQUEST already falls through to it.

Affected packages

Ecosystem Package Introduced Fixed