Cloudanix VulnDB

CVE-2026-98698

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's Wi-Fi code can cause computers to crash when they receive certain wireless network connection requests.

Exploitation
Adjacent Network
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Zero-length allocation via kmemdup in fils_encrypt_assoc_req produces ZERO_SIZE_PTR, which sg_init_one places into a scatterlist; this triggers kernel BUG under CONFIG_DEBUG_SG or passes an invalid page to the AES-SIV crypto backend.

Why it matters to the business

Wireless-enabled Linux systems may experience kernel crashes or instability when processing certain 802.11 association frames, leading to service disruption on Wi-Fi infrastructure and client devices.

How an attack unfolds

An attacker crafts a (Re)Association Request frame whose final element is a FILS Session element with no trailing data, causing the kernel to attempt an empty plaintext encryption path that mishandles the zero-size allocation and corrupts scatterlist state.

How to fix it

Apply the upstream fix that adds an early return for the zero-length plaintext case before CTR processing; rebuild and deploy updated kernel packages for all affected distributions.

How to confirm the fix worked

Confirm the patch is present by inspecting mac80211/fils.c for the new empty-payload guard; trigger the frame path in a test environment and verify absence of sg_set_buf BUG or invalid scatterlist warnings.

Typical attack path

  1. Attacker sends crafted 802.11 (Re)Association Request containing only a FILS Session element
  2. mac80211 calls fils_encrypt_assoc_req with zero crypt_len
  3. kmemdup(0) returns ZERO_SIZE_PTR
  4. sg_init_one receives invalid page address
  5. Kernel hits BUG in sg_set_buf or passes bogus page to crypto engine

How to detect it

Search kernel logs and dmesg for 'sg_set_buf' BUG, 'ZERO_SIZE_PTR', or scatterlist warnings originating from mac80211 or crypto routines during association processing.

  • BUG: unable to handle kernel NULL pointer dereference in sg_set_buf
  • mac80211: fils_encrypt_assoc_req
  • ZERO_SIZE_PTR passed to scatterlist

What your security team should do

  • Prioritize kernel updates on all Wi-Fi enabled systems within the next maintenance window
  • Monitor kernel logs for sg_set_buf or scatterlist errors on wireless interfaces
  • Restrict untrusted 802.11 association traffic until patches are deployed

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: handle empty FILS association request payload fils_encrypt_assoc_req() accepts a (Re)Association Request frame whose last element is the FILS Session element. crypt_len is then zero and aes_siv_encrypt() is called with an empty plaintext. kmemdup() returns ZERO_SIZE_PTR for a zero-length allocation, so the unconditional sg_init_one() puts an invalid page into the scatterlist. With CONFIG_DEBUG_SG this triggers a kernel BUG in sg_set_buf(); without the debug check the bogus page is handed to the crypto backend. AES-SIV is defined for empty plaintext and the S2V result is then the complete output, so handle this case before the CTR step, which has nothing to encrypt.

Affected packages

Ecosystem Package Introduced Fixed