CVE-2026-98874

What it actually does

The iwlwifi driver contained an invalid assumption that WoWLAN suspend would always occur with either an active connection or netdetect configured, causing an unnecessary WARN_ON() to fire and return an error in the valid disconnected case.

Why it matters to the business

Affected Linux systems may log spurious kernel warnings or experience minor suspend/resume disruptions when Wake-on-WLAN is enabled without a network, producing operational noise but carrying negligible risk given low EPSS and absence from KEV.

How an attack unfolds

No remote or unauthenticated exploitation is possible; the flaw is a defensive coding error in the driver rather than an attacker-reachable condition. No named threat actors or campaigns are associated.

How to fix it

Upgrade to a Linux kernel containing the referenced iwlwifi mld fix that removes the WARN_ON() and correctly handles WoWLAN suspend without netdetect.

How to confirm the fix worked

Confirm the driver source no longer contains the removed WARN_ON() for the WoWLAN suspend path; test suspend/resume cycles with WoWLAN configured but no connection or netdetect active and verify clean operation without warnings.

Typical attack path

1. N/A - not an exploitable vulnerability

How to detect it

Search kernel logs and dmesg output for WARN_ON messages referencing iwlwifi, mld, WoWLAN suspend, or netdetect to determine whether the condition was previously hit on any system.

What your security team should do

• Prioritize kernel updates for systems using iwlwifi hardware within normal patch cycles
• Review kernel logs for any prior occurrences of the specific WoWLAN suspend warning
• No emergency action required given low EPSS and lack of KEV listing