UnratedFix available
wifi: mac80211: validate deauth frame length before reason access
Type: advisorySources: OSV
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate deauth frame length before reason access ieee80211_rx_mgmt_deauth() reads the deauth reason code before checking that the fixed field is actually present in the received frame. Validate the deauth frame length first and only then read the reason code.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 5.10.271, 5.15.222, 6.1.189, 6.12.111, 6.18.53, 6.6.158
- CVEs
- CVE-2026-98891
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 15:07 UTC · Revision 1
Source evidence
wifi: mac80211: validate deauth frame length before reason access
core-osv · Original sourcePublished 23 Oct 2026, 11:37 UTC
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate deauth frame length before reason access ieee80211_rx_mgmt_deauth() reads the deauth reason code before checking that the fixed field is actually present in the received frame. Validate the deauth frame length first and only then read the reason code.
osv:CVE-2026-98891
Kernel
Fixed versions: 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.111, 6.18.53
Complete source record
{
"id": "bfa2b2af25be9ec17cfb7e81a0321b21e6b9933e9a6ae91e7ffdbd8dc270a758",
"url": "https://osv.dev/vulnerability/CVE-2026-98891",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "wifi: mac80211: validate deauth frame length before reason access",
"summary": "In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate deauth frame length before reason access ieee80211_rx_mgmt_deauth() reads the deauth reason code before checking that the fixed field is actually present in the received frame. Validate the deauth frame length first and only then read the reason code.",
"evidence": "osv:CVE-2026-98891",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.10.271",
"evidence": "/affected/1/ranges"
},
{
"value": "5.15.222",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.189",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.158",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.111",
"evidence": "/affected/1/ranges"
},
{
"value": "6.18.53",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CVE-2026-98891",
"aliases": [
"CVE-2026-98891"
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "c9c99f8938e41b878802d5d8481d6f7a212515b0"
},
{
"fixed": "51092dc769f021e9634474e1bd5a561da477fbdb"
},
{
"fixed": "a6ed4c00ccdc15011a73daa2b38af9fc5a2c543e"
},
{
"fixed": "80d1a110e9096b5bf41497f6b151154084862385"
},
{
"fixed": "a78689e2beed200d4590318612c74ae25c9408cf"
},
{
"fixed": "7a5ef1fd654d0e90d59aa32c881789c8bcc4125a"
},
{
"fixed": "9df64ad43e1f2c036667bba2bf385e9d7b3af564"
},
{
"fixed": "4a360c6e18dfa9d70006c7247a6a8cc8dfe0d60f"
}
]
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98891.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.2.0"
},
{
"fixed": "5.10.271"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.222"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.1.189"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.158"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.111"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.18.53"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98891.json"
}
}
],
"modified": "2026-10-28T02:30:36.756300572Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/4a360c6e18dfa9d70006c7247a6a8cc8dfe0d60f",
"https://git.kernel.org/stable/c/51092dc769f021e9634474e1bd5a561da477fbdb",
"https://git.kernel.org/stable/c/7a5ef1fd654d0e90d59aa32c881789c8bcc4125a",
"https://git.kernel.org/stable/c/80d1a110e9096b5bf41497f6b151154084862385",
"https://git.kernel.org/stable/c/9df64ad43e1f2c036667bba2bf385e9d7b3af564",
"https://git.kernel.org/stable/c/a6ed4c00ccdc15011a73daa2b38af9fc5a2c543e",
"https://git.kernel.org/stable/c/a78689e2beed200d4590318612c74ae25c9408cf",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98891.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-98891",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98891.json"
}
},
"related_cves": [
{
"value": "CVE-2026-98891",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 504018,
"published_at": "2026-10-23T11:37:51.588+00:00"
}