Cloudanix VulnDB

CVE-2026-98891

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in how Linux handles certain Wi-Fi disconnection messages could let attackers crash wireless connections on affected devices.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Data Exposure
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

ieee80211_rx_mgmt_deauth reads the reason code field without first validating that the fixed-length portion of the deauth frame is present, allowing access beyond supplied frame data.

Why it matters to the business

Wireless-enabled Linux systems may experience crashes or instability when receiving short or malformed deauthentication frames, disrupting network connectivity until reboot or recovery.

How an attack unfolds

An attacker transmits a crafted 802.11 deauth frame shorter than the expected fixed header; the kernel function accesses the reason code before length validation, triggering invalid memory read or crash.

How to fix it

Apply the upstream kernel patch that moves the deauth frame length validation before reason code access; rebuild and deploy updated kernels to all affected systems.

How to confirm the fix worked

Confirm the presence of an explicit length check on the deauth skb before the reason code dereference inside ieee80211_rx_mgmt_deauth; test with deliberately truncated deauth frames.

Typical attack path

  1. Craft IEEE 802.11 deauth management frame with length shorter than required fixed fields
  2. Transmit frame to target Linux device over wireless medium
  3. Trigger ieee80211_rx_mgmt_deauth processing path
  4. Read reason code from insufficient buffer

How to detect it

Search kernel logs and netlink traces for oops or warnings originating from mac80211 deauth processing; inspect wireless packet captures for unusually short deauth frames targeting Linux hosts.

What your security team should do

  • Prioritize kernel updates on all Wi-Fi enabled Linux hosts within normal patch windows given low EPSS
  • Enable kernel crash logging and mac80211 debug to capture related oops
  • Review wireless driver configurations for any non-default deauth handling

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate deauth frame length before reason access ieee80211_rx_mgmt_deauth() reads the deauth reason code before checking that the fixed field is actually present in the received frame. Validate the deauth frame length first and only then read the reason code.

Affected packages

Ecosystem Package Introduced Fixed