CVE-2026-98703
NoneCVSS
—
EPSS
0.2%
Published
Oct 18, 2026
CISA due date
—
Cloudanix analysis
A Linux WiFi driver allowed invalid numbers to be written through a troubleshooting file, which could corrupt internal memory and crash the system even though only administrators could reach the file.
- Exploitation
- Local Privilege
- Attacker needs
- High Privilege
- Complexity
- Theoretical
- Impact
- Data Tampering
- Component
- OS kernel
- Class
- Buffer Overflow
- Remediation
- Patch
- Effort
- Low
- Patch risk
- Low
What it actually does
Out-of-bounds array access in minstrel_ht_set_rate() and related functions when an arbitrary u32 value is written to the fixed_rate_idx debugfs attribute, allowing the index to select beyond the 42-entry minstrel_mcs_groups[] and 10-entry rates[] arrays and corrupt adjacent kernel memory with rate statistics.
Why it matters to the business
Kernel memory corruption or crashes on Linux WiFi devices using mac80211 minstrel_ht rate control; the issue is reachable only by root via debugfs so widespread remote exploitation is unlikely but still requires prompt patching to avoid instability in managed fleets.
How an attack unfolds
An attacker with root privileges on a Linux system writes an out-of-range value such as 65535 to the fixed_rate_idx debugfs file; minstrel_ht_update_stats() copies it into internal rate arrays and minstrel_ht_set_rate() performs unchecked indexing that dereferences and writes beyond array bounds, corrupting kernel structures.
How to fix it
Apply the upstream fix that rejects any value other than a valid group/rate pair or U32_MAX when writing the fixed_rate_idx debugfs file; rebuild and deploy the patched kernel to all affected systems.
How to confirm the fix worked
Confirm the patched kernel source contains the new validation check before the copy into max_tp_rate[]/max_prob_rate; attempt to write an out-of-range value and verify it is rejected without triggering an out-of-bounds access.
Typical attack path
- Obtain root shell or equivalent access on target Linux host
- Locate the minstrel_ht debugfs directory for the wireless interface
- Write an invalid u32 index value to the fixed_rate_idx attribute
- Trigger minstrel rate statistics update via traffic or timers
- Observe kernel oops, memory corruption, or UBSAN report
How to detect it
Review kernel logs for array-index-out-of-bounds reports or oopses mentioning minstrel_ht_set_rate or minstrel_ht_update_stats; audit debugfs write attempts to fixed_rate_idx on wireless interfaces.
What your security team should do
- Prioritize kernel updates on all systems exposing mac80211 debugfs
- Restrict debugfs mounts to the minimum required users and audit writes
- Monitor for kernel oops reports referencing minstrel_ht_set_rate
- Test patched kernels in staging before broad rollout
The record
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: minstrel_ht: validate fixed rate index The fixed_rate_idx debugfs file is a plain u32 attribute, so any value can be written to it. minstrel_ht_update_stats() then copies the value into mi->max_tp_rate[] and mi->max_prob_rate, and minstrel_ht_set_rate() uses MI_RATE_GROUP()/MI_RATE_IDX() to index minstrel_mcs_groups[] (42 entries) and mi->groups[].rates[] (10 entries) with it. Writing e.g. 65535 selects group 4095 and rate index 15, far outside both arrays. The out-of-bounds entries are dereferenced and updated as struct minstrel_rate_stats (retry counts, etc.), so the invalid index corrupts adjacent kernel memory. With CONFIG_UBSAN_BOUNDS the access is reported as an array-index-out-of-bounds in minstrel_ht_set_rate(). Only a valid group/rate pair, or U32_MAX to disable fixed rate processing, can be used safely, so reject any other value when the debugfs file is written. The file is only reachable through a root-only debugfs mount, so this is not a privilege boundary. The out-of-bounds access is still a bug that must not be reachable through a writable debugfs attribute.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|