CVE-2026-98700 - Vulnerability Details

- wifi: mac80211: set info->band for 802.3 encap offload frames

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: set info->band for 802.3 encap offload frames

Unlike the 802.11 TX paths, ieee80211_8023_xmit() does not set
info->band from the channel context on non-MLD interfaces. It stays at
0, so ieee80211_get_tx_rates() uses the wrong band for these frames.

Set it the same way as ieee80211_build_hdr(): drop the frame if there is
no channel context, and leave the band at 0 on MLD interfaces.

Published: 2026-10-18

Score: 3.3 Low

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A logic flaw in the Linux kernel WiFi stack causes offloaded frames with 802.3 encapsulation to retain a band value of zero instead of inheriting the correct channel context. As a result, the rate calculation routine selects an inappropriate frequency band for these frames.

Affected Systems

All Linux kernel builds that include the unpatched code are affected, regardless of distribution. The issue resides in the mac80211 WiFi driver module and applies to non‑MLD WiFi interfaces. Any kernel version that incorporates the referenced commits has been fixed; vendors should verify their kernel images contain these changes.

Risk and Exploitability

The CVSS score is 3.3 and the EPSS score is <1%, indicating a low quantitative risk. The vulnerability is not listed in the CISA KEV catalog. The error occurs when the kernel sends 802.3‑encapsulated offloaded frames through a non‑MLD WiFi interface, causing the rate calculation routine to use an incorrect band. The likely attack vector is an attacker who can send crafted Wi‑Fi frames to the interface. The bug does not provide direct memory corruption or privilege escalation but could affect the correctness of band selection for transmitted frames.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`50ff477a8639fa1fbbeecb5a6f2f8b6c5557ecec`	affected	< a182c0bbb3c0332189f04b241a71455539f58433
`50ff477a8639fa1fbbeecb5a6f2f8b6c5557ecec`	affected	< 3ce62fa18975316547c971cf60c4533077a60c48
`50ff477a8639fa1fbbeecb5a6f2f8b6c5557ecec`	affected	< c85c0d897b91c74c0a2c0d0ad29f1ae970dc1e0d
`50ff477a8639fa1fbbeecb5a6f2f8b6c5557ecec`	affected	< 6535f7084d95873785a7a93cdca05e8ee83b5601
`50ff477a8639fa1fbbeecb5a6f2f8b6c5557ecec`	affected	< 93c1b247224a32f546b616a8fe87b9bab20f0a7f
`50ff477a8639fa1fbbeecb5a6f2f8b6c5557ecec`	affected	< 9cedbfde1450028f530e9af950f53491fcaebfeb
`50ff477a8639fa1fbbeecb5a6f2f8b6c5557ecec`	affected	< 2d9c5525bbc1a548cdc9c4def3cd7fbfc7c66b5b
`50ff477a8639fa1fbbeecb5a6f2f8b6c5557ecec`	affected	< 4febc02cd02f021f2b6d0768332be643ef14a12d

Linux

affected

Version	Status	Constraints
`5.7`	affected	—
`0`	unaffected	< 5.7
`5.10.273`	unaffected	≤ 5.10.*
`5.15.224`	unaffected	≤ 5.15.*
`6.1.191`	unaffected	≤ 6.1.*
`6.6.160`	unaffected	≤ 6.6.*
`6.12.113`	unaffected	≤ 6.12.*
`6.18.56`	unaffected	≤ 6.18.*
`7.2.10`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[50ff477a8639fa1fbbeecb5a6f2f8b6c5557ecec,93c1b247224a32f546b616a8fe87b9bab20f0a7f)`	affected	code_commit	—
`[50ff477a8639fa1fbbeecb5a6f2f8b6c5557ecec,9cedbfde1450028f530e9af950f53491fcaebfeb)`	affected	code_commit	—
`[50ff477a8639fa1fbbeecb5a6f2f8b6c5557ecec,2d9c5525bbc1a548cdc9c4def3cd7fbfc7c66b5b)`	affected	code_commit	—
`[50ff477a8639fa1fbbeecb5a6f2f8b6c5557ecec,4febc02cd02f021f2b6d0768332be643ef14a12d)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.7`	affected	generic	—
`[0,5.7)`	unaffected	generic	—
`[6.12.113,6.13.0)`	unaffected	semver	—
`[6.18.56,6.19.0)`	unaffected	semver	—
`[7.2.10,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the kernel to a version that includes the commits referenced in the advisory (e.g., 2d9c5525bbc1a548cdc9c4def3cd7fbfc7c66b5b, 4febc02cd02f021f2b6d0768332be643ef14a12d, 93c1b247224a32f546b616a8fe87b9bab20f0a7f, or 9cedbfde1450028f530e9af950f53491fcaebfeb).
If a kernel upgrade is not immediately possible, disable 802.3 encapsulation offloading on affected Wi‑Fi interfaces to prevent the incorrect band selection.
If staying on the legacy kernel, apply the patch changes manually from the referenced commits into your kernel source tree and rebuild the kernel.

Generated by OpenCVE AI on October 23, 2026 at 06:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4850-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00176.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98700.mbox
https://git.kernel.org/stable/c/2d9c5525bbc1a548cdc9c4def3cd7fbfc7c66b5b
https://git.kernel.org/stable/c/3ce62fa18975316547c971cf60c4533077a60c48
https://git.kernel.org/stable/c/4febc02cd02f021f2b6d0768332be643ef14a12d
https://git.kernel.org/stable/c/6535f7084d95873785a7a93cdca05e8ee83b5601
https://git.kernel.org/stable/c/93c1b247224a32f546b616a8fe87b9bab20f0a7f
https://git.kernel.org/stable/c/9cedbfde1450028f530e9af950f53491fcaebfeb
https://git.kernel.org/stable/c/a182c0bbb3c0332189f04b241a71455539f58433
https://git.kernel.org/stable/c/c85c0d897b91c74c0a2c0d0ad29f1ae970dc1e0d
https://nvd.nist.gov/vuln/detail/CVE-2026-98700
https://www.cve.org/CVERecord?id=CVE-2026-98700

History

Fri, 30 Oct 2026 12:45:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/3ce62fa18975316547c971cf60c4533077a60c48 https://git.kernel.org/stable/c/a182c0bbb3c0332189f04b241a71455539f58433 https://git.kernel.org/stable/c/c85c0d897b91c74c0a2c0d0ad29f1ae970dc1e0d

Fri, 23 Oct 2026 00:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-665

Thu, 22 Oct 2026 12:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-909
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98700.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98700 https://www.cve.org/CVERecord?id=CVE-2026-98700
Metrics	threat_severity `None`	cvssV3_1 `{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'}` threat_severity `Low`

Wed, 21 Oct 2026 13:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/6535f7084d95873785a7a93cdca05e8ee83b5601

Sun, 18 Oct 2026 23:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-665

Sun, 18 Oct 2026 16:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: set info->band for 802.3 encap offload frames Unlike the 802.11 TX paths, ieee80211_8023_xmit() does not set info->band from the channel context on non-MLD interfaces. It stays at 0, so ieee80211_get_tx_rates() uses the wrong band for these frames. Set it the same way as ieee80211_build_hdr(): drop the frame if there is no channel context, and leave the band at 0 on MLD interfaces.
Title		wifi: mac80211: set info->band for 802.3 encap offload frames
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2d9c5525bbc1a548cdc9c4def3cd7fbfc7c66b5b https://git.kernel.org/stable/c/4febc02cd02f021f2b6d0768332be643ef14a12d https://git.kernel.org/stable/c/93c1b247224a32f546b616a8fe87b9bab20f0a7f https://git.kernel.org/stable/c/9cedbfde1450028f530e9af950f53491fcaebfeb

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-18T15:46:30.043Z

Updated: 2026-10-30T12:38:51.724Z

Reserved: 2026-09-25T10:25:14.365Z

Link: CVE-2026-98700

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-18T16:17:23.497

Modified: 2026-10-30T13:21:19.167

Link: CVE-2026-98700

Redhat

Severity : Low

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98700 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-23T06:15:13Z

Weaknesses

CWE-909
Missing Initialization of Resource

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object