wifi: mac80211: reject invalid 320 MHz CSA bandwidth
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reject invalid 320 MHz CSA bandwidth The HT/VHT channel definition validator can receive a 320 MHz bandwidth indication from a received CSA frame on a non-6 GHz link. It warns for this unsupported width but continues with an uninitialized vht_operation.chan_width, which is then read by ieee80211_chandef_vht_oper(). With panic_on_warn enabled, this lets a received frame panic the kernel. Reject the channel definition before entering the VHT operation conversion. This preserves the existing CSA fallback while avoiding both the warning and the uninitialized read.
CVE-2026-98702
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-98702
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "21c3f8f95554feff9bed15703e89adbe582e0383",
"lessThan": "cf0ddacce173890407ed3fa50c8ea9b3c0cc0e16",
"versionType": "git"
},
{
"status": "affected",
"version": "21c3f8f95554feff9bed15703e89adbe582e0383",
"lessThan": "1892e71aa2e5ee667d87c6e49e3661f5e290303b",
"versionType": "git"
},
{
"status": "affected",
"version": "21c3f8f95554feff9bed15703e89adbe582e0383",
"lessThan": "79b3ce0d881cd6e5d4d3496b19f5cc5e7089a56c",
"versionType": "git"
},
{
"status": "affected",
"version": "21c3f8f95554feff9bed15703e89adbe582e0383",
"lessThan": "56e236759f0a8dc910c2ae7cd3c161f298ee5794",
"versionType": "git"
}
],
"programFiles": [
"net/mac80211/spectmgmt.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.9",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/mac80211/spectmgmt.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-98702
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #38694 · Revision 1
- Added to Heist Feed
- Publisher date