CVE-2026-98406 - Vulnerability Details

- wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver

ieee80211_set_bitrate_mask() checks if the interface is running via
ieee80211_sdata_running(), but it does not check if the interface is
still present in the driver.

When sdata is running but IEEE80211_SDATA_IN_DRIVER is not set, the
call reaches drv_set_bitrate_mask() in driver-ops.h which hits

wlan1: Failed check-sdata-in-driver check, flags: 0x0
WARNING: net/mac80211/driver-ops.h:884 at drv_set_bitrate_mask

Syzkaller triggers this via wext SIOCSIWRATE ioctl. The Call Trace shows
wext_ioctl_dispatch() in wext-core.c dispatching the ioctl, calling
ioctl_standard_call() for SIOCSIWRATE, which calls cfg80211_wext_siwrate()
in wext-compat.c. That builds a bitrate mask and calls
rdev_set_bitrate_mask() which ends up in ieee80211_set_bitrate_mask() in
cfg.c. The interface is marked running via SDATA_STATE_RUNNING but
flags is 0, so check_sdata_in_driver() fails.

When the interface is being torn down, or when wext ioctl is issued
during interface bringup before drv_add_interface() sets IN_DRIVER, the
running check passes while IN_DRIVER is clear.

Check IEEE80211_SDATA_IN_DRIVER in ieee80211_set_bitrate_mask() before
calling the driver, returning -ENETDOWN. This avoids the WARN_ONCE in
driver-ops.h and matches other cfg.c operations that bail early when not
in driver.

This change should be safe because wiphy mutex is held in
cfg80211_wext_siwrate() via guard(wiphy), and IN_DRIVER is set/cleared
under RTNL and wiphy paths in drv_add_interface() and
drv_remove_interface() in driver-ops.c, so the check is race-free
against driver add/remove. Returning -ENETDOWN is the same error other
not-running paths use and does not introduce new locking.

[also add second syzbot report]

Published: 2026-10-14

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw exists in the Linux kernel's mac80211 subsystem. When a wireless interface is marked running but has not yet been registered with the driver, the ieee80211_set_bitrate_mask() handler does not verify the IEEE80211_SDATA_IN_DRIVER flag before calling drv_set_bitrate_mask(). This omission triggers a WARN_ONCE in driver‑ops.h and logs a "Failed check‑sdata‑in‑driver" message. The vulnerability does not enable code execution or privilege escalation; it primarily results in noisy kernel logs and could degrade diagnostic efforts.

Affected Systems

All Linux kernel builds released before the commit that inserts the driver presence check. This includes the upstream kernel sources and the kernel packages distributed by major Linux distributions such as Debian, Ubuntu, RHEL, CentOS, SUSE, Fedora, and others, until a kernel containing the patch is installed.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity. The EPSS score is less than 1% and the vulnerability is not listed in CISA’s KEV catalog, implying a low probability of exploitation. Based on the description, the likely attack vector is a local privileged user who can invoke the SIOCSIWRATE ioctl while a wireless interface is being brought up or torn down. The exploit would only produce kernel warning messages and not grant further access or affect system integrity.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`554a43d5e77e8256aa9685ffd19ad555e6f77979`	affected	< 4ba86c44b2fcb1c3175caa2456b6d58f483446ab
`554a43d5e77e8256aa9685ffd19ad555e6f77979`	affected	< 4095b66acae9893dd13deb39a4331651cb2f822b
`554a43d5e77e8256aa9685ffd19ad555e6f77979`	affected	< c2cd9c44777cf97be3e35c10b7c2d8f59ebb9306
`554a43d5e77e8256aa9685ffd19ad555e6f77979`	affected	< 0d1700394e9f5d0bd9bebad8d5a50edf983f52fd
`554a43d5e77e8256aa9685ffd19ad555e6f77979`	affected	< 7978dda63d2b109ea9c3f7a096cd1aac6542cd54
`554a43d5e77e8256aa9685ffd19ad555e6f77979`	affected	< 432c8532d5ccc2af77da43ed6ef1c80495a4efe8
`554a43d5e77e8256aa9685ffd19ad555e6f77979`	affected	< c4ee5685af444024e6222ce29f6ed36adc44ffc3
`554a43d5e77e8256aa9685ffd19ad555e6f77979`	affected	< da2ca406f45a6e21760243152ed8d2e8e72915c2

Linux

affected

Version	Status	Constraints
`3.5`	affected	—
`0`	unaffected	< 3.5
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.112`	unaffected	≤ 6.12.*
`6.18.54`	unaffected	≤ 6.18.*
`7.2.8`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[554a43d5e77e8256aa9685ffd19ad555e6f77979,4ba86c44b2fcb1c3175caa2456b6d58f483446ab)`	affected	code_commit	—
`[554a43d5e77e8256aa9685ffd19ad555e6f77979,4095b66acae9893dd13deb39a4331651cb2f822b)`	affected	code_commit	—
`[554a43d5e77e8256aa9685ffd19ad555e6f77979,c2cd9c44777cf97be3e35c10b7c2d8f59ebb9306)`	affected	code_commit	—
`[554a43d5e77e8256aa9685ffd19ad555e6f77979,0d1700394e9f5d0bd9bebad8d5a50edf983f52fd)`	affected	code_commit	—
`[554a43d5e77e8256aa9685ffd19ad555e6f77979,7978dda63d2b109ea9c3f7a096cd1aac6542cd54)`	affected	code_commit	—
`[554a43d5e77e8256aa9685ffd19ad555e6f77979,432c8532d5ccc2af77da43ed6ef1c80495a4efe8)`	affected	code_commit	—
`[554a43d5e77e8256aa9685ffd19ad555e6f77979,c4ee5685af444024e6222ce29f6ed36adc44ffc3)`	affected	code_commit	—
`[554a43d5e77e8256aa9685ffd19ad555e6f77979,da2ca406f45a6e21760243152ed8d2e8e72915c2)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.5`	affected	generic	—
`[0,3.5)`	unaffected	generic	—
`[5.10.271,5.11.0)`	unaffected	semver	—
`[5.15.222,5.16.0)`	unaffected	semver	—
`[6.1.189,6.2.0)`	unaffected	semver	—
`[6.6.158,6.7.0)`	unaffected	semver	—
`[6.12.112,6.13.0)`	unaffected	semver	—
`[6.18.54,6.19.0)`	unaffected	semver	—
`[7.2.8,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the commit adding the IEEE80211_SDATA_IN_DRIVER check, or apply the supplied patch to the kernel source.
If a kernel upgrade cannot be performed promptly, avoid issuing the SIOCSIWRATE ioctl while the wireless interface is transitioning, ensuring that the interface is fully registered with the driver before calling the ioctl.
Monitor kernel logs for repeated "Failed check‑sdata‑in‑driver" warnings and adjust logging verbosity or kernel debugging settings if necessary to reduce noise.

Generated by OpenCVE AI on October 17, 2026 at 02:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4841-1	linux security update
Debian DLA	DLA-4850-1	linux-6.12 security update
Debian DSA	DSA-6568-1	linux security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00216.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98406.mbox
https://git.kernel.org/stable/c/0d1700394e9f5d0bd9bebad8d5a50edf983f52fd
https://git.kernel.org/stable/c/4095b66acae9893dd13deb39a4331651cb2f822b
https://git.kernel.org/stable/c/432c8532d5ccc2af77da43ed6ef1c80495a4efe8
https://git.kernel.org/stable/c/4ba86c44b2fcb1c3175caa2456b6d58f483446ab
https://git.kernel.org/stable/c/7978dda63d2b109ea9c3f7a096cd1aac6542cd54
https://git.kernel.org/stable/c/c2cd9c44777cf97be3e35c10b7c2d8f59ebb9306
https://git.kernel.org/stable/c/c4ee5685af444024e6222ce29f6ed36adc44ffc3
https://git.kernel.org/stable/c/da2ca406f45a6e21760243152ed8d2e8e72915c2
https://nvd.nist.gov/vuln/detail/CVE-2026-98406
https://www.cve.org/CVERecord?id=CVE-2026-98406

History

Sat, 17 Oct 2026 00:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-703

Fri, 16 Oct 2026 12:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-617
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98406.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98406 https://www.cve.org/CVERecord?id=CVE-2026-98406
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Fri, 16 Oct 2026 07:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-703

Thu, 15 Oct 2026 23:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-20 CWE-398

Thu, 15 Oct 2026 06:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-20 CWE-398

Wed, 14 Oct 2026 13:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver ieee80211_set_bitrate_mask() checks if the interface is running via ieee80211_sdata_running(), but it does not check if the interface is still present in the driver. When sdata is running but IEEE80211_SDATA_IN_DRIVER is not set, the call reaches drv_set_bitrate_mask() in driver-ops.h which hits wlan1: Failed check-sdata-in-driver check, flags: 0x0 WARNING: net/mac80211/driver-ops.h:884 at drv_set_bitrate_mask Syzkaller triggers this via wext SIOCSIWRATE ioctl. The Call Trace shows wext_ioctl_dispatch() in wext-core.c dispatching the ioctl, calling ioctl_standard_call() for SIOCSIWRATE, which calls cfg80211_wext_siwrate() in wext-compat.c. That builds a bitrate mask and calls rdev_set_bitrate_mask() which ends up in ieee80211_set_bitrate_mask() in cfg.c. The interface is marked running via SDATA_STATE_RUNNING but flags is 0, so check_sdata_in_driver() fails. When the interface is being torn down, or when wext ioctl is issued during interface bringup before drv_add_interface() sets IN_DRIVER, the running check passes while IN_DRIVER is clear. Check IEEE80211_SDATA_IN_DRIVER in ieee80211_set_bitrate_mask() before calling the driver, returning -ENETDOWN. This avoids the WARN_ONCE in driver-ops.h and matches other cfg.c operations that bail early when not in driver. This change should be safe because wiphy mutex is held in cfg80211_wext_siwrate() via guard(wiphy), and IN_DRIVER is set/cleared under RTNL and wiphy paths in drv_add_interface() and drv_remove_interface() in driver-ops.c, so the check is race-free against driver add/remove. Returning -ENETDOWN is the same error other not-running paths use and does not introduce new locking. [also add second syzbot report]
Title		wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0d1700394e9f5d0bd9bebad8d5a50edf983f52fd https://git.kernel.org/stable/c/4095b66acae9893dd13deb39a4331651cb2f822b https://git.kernel.org/stable/c/432c8532d5ccc2af77da43ed6ef1c80495a4efe8 https://git.kernel.org/stable/c/4ba86c44b2fcb1c3175caa2456b6d58f483446ab https://git.kernel.org/stable/c/7978dda63d2b109ea9c3f7a096cd1aac6542cd54 https://git.kernel.org/stable/c/c2cd9c44777cf97be3e35c10b7c2d8f59ebb9306 https://git.kernel.org/stable/c/c4ee5685af444024e6222ce29f6ed36adc44ffc3 https://git.kernel.org/stable/c/da2ca406f45a6e21760243152ed8d2e8e72915c2

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-14T13:27:41.192Z

Updated: 2026-10-19T09:18:59.519Z

Reserved: 2026-09-25T10:25:14.347Z

Link: CVE-2026-98406

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-14T14:17:51.710

Modified: 2026-10-19T10:18:45.657

Link: CVE-2026-98406

Redhat

Severity : Low

Publid Date: 2026-10-14T00:00:00Z

Links: CVE-2026-98406 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-19T18:45:01Z

Weaknesses

CWE-617
Reachable Assertion

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object