Description
In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: validate TX status rate metadata

minstrel_ht_tx_status() converts the HT/VHT rate reported in a TX status
into a group and rate index and uses those to index the minstrel_ht rate
tables. The existing validation only checked that an entry was present
and had tries recorded; it did not check that the reported MCS, spatial
stream count and bandwidth are representable by the tables, so malformed
metadata passed to minstrel_ht_get_stats() or
minstrel_ht_ri_get_stats() could be used as an out-of-bounds index.

Validate the rate metadata in the common TX status path instead of only
in minstrel_ht, since the values are used by more than rate control.
The legacy ieee80211_tx_rate array and the rate_info based entries are
sanitized in ieee80211_tx_status_ext() and ieee80211_tx_rate_update()
before any consumer runs: an entry that does not describe a valid rate
for its encoding is dropped. minstrel_ht keeps the checks that depend
on its own tables, i.e. the supported number of spatial streams, the MCS
group size and the supported bandwidths.

This does not take away the driver's responsibility to report sane
values, it only prevents a single bad report from corrupting mac80211
state. No WARN_ON() is added: with panic_on_warn a driver bug would
otherwise turn into a denial of service.
Published: 2026-10-18
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch
AI Analysis

Impact

The Linux kernel’s mac80211 wireless subsystem originally validated the MCS and bandwidth values of transmitted frames only loosely, allowing a malformed TX status rate metadata entry to be used as an index into internal rate tables. This missing bounds check caused an out‑of‑bounds array access that could corrupt kernel state and result in a kernel crash, effectively denying service to the host. The flaw is a classic out‑of‑bounds read/write identified by CWE‑787.

Affected Systems

The issue is present in all versions of the Linux kernel that include the mac80211 subsystem and have not applied the patch that adds proper rate‑metadata validation. The advisory does not list specific kernel releases, so any build containing the vulnerable code before the referenced commit is affected.

Risk and Exploitability

The CVSS score of 5.3 indicates a medium severity vulnerability, and an EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be via manipulated Wi‑Fi frames or driver interactions that deliver corrupted TX status metadata to a vulnerable system; the kernel crash would be silent until a watchdog or external monitor detects the loss of service.

Generated by OpenCVE AI on October 24, 2026 at 02:35 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update to a kernel version that contains the patch for validating TX status rate metadata.
  • If a kernel upgrade is not immediately possible, disable or remove Wi‑Fi hardware that may load untrusted drivers and route traffic through more secure interfaces.
  • If custom drivers are in use, enforce strict validation of rate metadata before passing it to the kernel.

Generated by OpenCVE AI on October 24, 2026 at 02:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 24 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Sun, 18 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-787

Sun, 18 Oct 2026 16:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate TX status rate metadata minstrel_ht_tx_status() converts the HT/VHT rate reported in a TX status into a group and rate index and uses those to index the minstrel_ht rate tables. The existing validation only checked that an entry was present and had tries recorded; it did not check that the reported MCS, spatial stream count and bandwidth are representable by the tables, so malformed metadata passed to minstrel_ht_get_stats() or minstrel_ht_ri_get_stats() could be used as an out-of-bounds index. Validate the rate metadata in the common TX status path instead of only in minstrel_ht, since the values are used by more than rate control. The legacy ieee80211_tx_rate array and the rate_info based entries are sanitized in ieee80211_tx_status_ext() and ieee80211_tx_rate_update() before any consumer runs: an entry that does not describe a valid rate for its encoding is dropped. minstrel_ht keeps the checks that depend on its own tables, i.e. the supported number of spatial streams, the MCS group size and the supported bandwidths. This does not take away the driver's responsibility to report sane values, it only prevents a single bad report from corrupting mac80211 state. No WARN_ON() is added: with panic_on_warn a driver bug would otherwise turn into a denial of service.
Title wifi: mac80211: validate TX status rate metadata
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-19T09:26:17.090Z

Reserved: 2026-09-25T10:25:14.372Z

Link: CVE-2026-98824

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-18T16:17:36.630

Modified: 2026-10-19T10:19:46.450

Link: CVE-2026-98824

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98824 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-24T02:45:17Z

Weaknesses