Skip to content
Heist/ feed
High

wifi: cfg80211: don't filter by BSS type when removing stale entries

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't filter by BSS type when removing stale entries When an assoc AP switches to a channel that already has a BSS entry, cfg80211_update_assoc_bss_entry() removes that entry before rehashing the real one, since the two would otherwise collide in the BSS rbtree. The lookup for that entry also required it to match the connection's BSS type, so an entry advertising e.g. the IBSS capability bit was left in place, and the following cfg80211_rehash_bss() then ran into it: WARN_ON(!cmp) Changing the type shouldn't really happen, but can be triggered by a rogue AP/device, so drop the check and remove any entries matching the comparison.

Announced Source revision 1
Original source ↗

CVE-2026-98339

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-98339

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
        "lessThan": "6ef87a853327434ae1cd9c5a2c27a557fb4047fc",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
        "lessThan": "1380ee3a202dbb9f8e8b3c3b87eb410450d57799",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
        "lessThan": "fb445ec7480da5d2b82bf681e3b4313603722729",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
        "lessThan": "65fdb973bd905bc3f5cb045a04c1828f2d2a7e24",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
        "lessThan": "64e23a36d8f04811372365b44cfca325f8e0f4bb",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
        "lessThan": "6d2fd26185678038ef2ea11dd4d2e6eccbf2dd25",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
        "lessThan": "0aa44982125c86b47961be5ac1c82eddab8080f3",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "0afd425b1b64251f19b5d8d8b49bf56fefbc643f",
        "lessThan": "b377e1000d963e7182a987082b4b06580bd7ac84",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "net/wireless/scan.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5.4"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "5.4",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.10.271",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.222",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.189",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.158",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.112",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.54",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "7.2.8",
        "versionType": "semver",
        "lessThanOrEqual": "7.2.*"
      },
      {
        "status": "unaffected",
        "version": "7.3",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "net/wireless/scan.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-98339

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#38419 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement