wifi: mac80211: set up the TX info early to fix failure paths
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: set up the TX info early to fix failure paths The previous commit 2c51457d930f ("wifi: mac80211: free ack status frame on TX header build failure") cleaned up the leak, but still left the code a bit messy and the failed SKB didn't get reported to userspace. Fix this up by initialising skb->cb[] earlier, which allows using ieee80211_free_txskb() and therefore reports it for the failure in ieee80211_build_hdr(), and unifies the ieee80211_skb_resize() failure path with it.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 6.1.189, 6.12.112, 6.18.54, 6.6.158, 7.2.8
- CVEs
- CVE-2026-98325
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 04:59 UTC · Revision 1
Source evidence
wifi: mac80211: set up the TX info early to fix failure paths
core-osv · Original sourcePublished 6 Oct 2026, 08:46 UTC
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: set up the TX info early to fix failure paths The previous commit 2c51457d930f ("wifi: mac80211: free ack status frame on TX header build failure") cleaned up the leak, but still left the code a bit messy and the failed SKB didn't get reported to userspace. Fix this up by initialising skb->cb[] earlier, which allows using ieee80211_free_txskb() and therefore reports it for the failure in ieee80211_build_hdr(), and unifies the ieee80211_skb_resize() failure path with it.
osv:CVE-2026-98325
Kernel
Fixed versions: 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8
Complete source record
{
"id": "cef73dc29afc8abde240c6726affa575e3cdf34651a76d09a705e34e6c5e7aa6",
"url": "https://osv.dev/vulnerability/CVE-2026-98325",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "wifi: mac80211: set up the TX info early to fix failure paths",
"summary": "In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: set up the TX info early to fix failure paths The previous commit 2c51457d930f (\"wifi: mac80211: free ack status frame on TX header build failure\") cleaned up the leak, but still left the code a bit messy and the failed SKB didn't get reported to userspace. Fix this up by initialising skb->cb[] earlier, which allows using ieee80211_free_txskb() and therefore reports it for the failure in ieee80211_build_hdr(), and unifies the ieee80211_skb_resize() failure path with it.",
"evidence": "osv:CVE-2026-98325",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "6.1.189",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.158",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.112",
"evidence": "/affected/1/ranges"
},
{
"value": "6.18.54",
"evidence": "/affected/1/ranges"
},
{
"value": "7.2.8",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CVE-2026-98325",
"aliases": [
"CVE-2026-98325"
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "c3e7724b6bc2f25e46c38dbe68f09d71fafeafb8"
},
{
"fixed": "df711e9fa20d7e996711c7f43a11a71805bef78d"
},
{
"fixed": "420fcc2fdeae6ecd682d2b1605a0a54c88aed4aa"
},
{
"fixed": "36e6f0a5e6d7238f4023e77f423c1c1414374309"
},
{
"fixed": "0fb37d2b6cb829cebdaea80f39011469f474bdcc"
},
{
"fixed": "03d67414bd05b86029afc14535238a9393eac1c6"
},
{
"fixed": "50d3d79dc0743b616afb00d01a626c76758721f7"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "3.6.3"
},
{
"fixed": "3.7"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "fd39be7ff6f81f2dc91ba6e5f87944abef5b4802"
}
]
}
],
"versions": [
"v3.6.11",
"v3.6.10",
"v3.6.9",
"v3.6.8",
"v3.6.7",
"v3.6.6",
"v3.6.5",
"v3.6.4",
"v3.6.3"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98325.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.7.0"
},
{
"fixed": "6.1.189"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.158"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.112"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.18.54"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.19.0"
},
{
"fixed": "7.2.8"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98325.json"
}
}
],
"modified": "2026-10-28T02:30:25.977429659Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/03d67414bd05b86029afc14535238a9393eac1c6",
"https://git.kernel.org/stable/c/0fb37d2b6cb829cebdaea80f39011469f474bdcc",
"https://git.kernel.org/stable/c/36e6f0a5e6d7238f4023e77f423c1c1414374309",
"https://git.kernel.org/stable/c/420fcc2fdeae6ecd682d2b1605a0a54c88aed4aa",
"https://git.kernel.org/stable/c/50d3d79dc0743b616afb00d01a626c76758721f7",
"https://git.kernel.org/stable/c/df711e9fa20d7e996711c7f43a11a71805bef78d",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98325.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-98325",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98325.json"
}
},
"related_cves": [
{
"value": "CVE-2026-98325",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 492623,
"published_at": "2026-10-06T08:46:18.734+00:00"
}