Cloudanix VulnDB

CVE-2026-98824

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in how Linux handles wireless network speed reports could let a bad driver crash the system or allow unauthorized access.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Malformed TX status rate metadata (MCS, spatial stream count, or bandwidth) can be used as an out-of-bounds index into minstrel_ht rate tables, allowing corruption of mac80211 internal state.

Why it matters to the business

Wireless networking on affected Linux systems may become unstable or allow local privilege escalation or denial of service when a faulty driver reports invalid rate information.

How an attack unfolds

An attacker supplies a malicious wireless driver or hardware that reports invalid HT/VHT rate metadata in TX status; the kernel's minstrel_ht code then uses the unchecked values as array indices, leading to memory corruption.

How to fix it

Update to a kernel containing the fix that sanitizes rate metadata in ieee80211_tx_status_ext and ieee80211_tx_rate_update before any rate-control consumer runs. Reboot after applying the update.

How to confirm the fix worked

Confirm the running kernel version contains the commit that adds validation of rate metadata in the common TX status path; inspect dmesg or kernel logs for absence of prior warning conditions around minstrel_ht_get_stats.

Typical attack path

  1. Obtain local access or load a malicious kernel module/driver on the target
  2. Trigger transmission of frames that cause the driver to return crafted TX status reports
  3. Supply rate metadata with out-of-range MCS, NSS, or bandwidth values
  4. Trigger minstrel_ht_tx_status or related functions to perform the out-of-bounds access
  5. Achieve memory corruption leading to crash or code execution

How to detect it

Review kernel logs for oops, warnings, or panics originating from minstrel_ht_tx_status or mac80211 rate handling functions; correlate with recent wireless driver activity or module loads.

What your security team should do

  • Apply the upstream kernel patch or distribution update that validates TX status rates
  • Restrict loading of untrusted wireless drivers or kernel modules until systems are updated
  • Monitor for wireless-related kernel panics or oops reports on affected hosts

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate TX status rate metadata minstrel_ht_tx_status() converts the HT/VHT rate reported in a TX status into a group and rate index and uses those to index the minstrel_ht rate tables. The existing validation only checked that an entry was present and had tries recorded; it did not check that the reported MCS, spatial stream count and bandwidth are representable by the tables, so malformed metadata passed to minstrel_ht_get_stats() or minstrel_ht_ri_get_stats() could be used as an out-of-bounds index. Validate the rate metadata in the common TX status path instead of only in minstrel_ht, since the values are used by more than rate control. The legacy ieee80211_tx_rate array and the rate_info based entries are sanitized in ieee80211_tx_status_ext() and ieee80211_tx_rate_update() before any consumer runs: an entry that does not describe a valid rate for its encoding is dropped. minstrel_ht keeps the checks that depend on its own tables, i.e. the supported number of spatial streams, the MCS group size and the supported bandwidths. This does not take away the driver's responsibility to report sane values, it only prevents a single bad report from corrupting mac80211 state. No WARN_ON() is added: with panic_on_warn a driver bug would otherwise turn into a denial of service.

Affected packages

Ecosystem Package Introduced Fixed