{"id":"CVE-2026-98698","kind":"vulnerability","aliases":["CVE-2026-98698"],"related":[],"title":"Linux kernel: empty FILS association request can crash Wi-Fi stack","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: handle empty FILS association request payload\n\nfils_encrypt_assoc_req() accepts a (Re)Association Request frame whose\nlast element is the FILS Session element.  crypt_len is then zero and\naes_siv_encrypt() is called with an empty plaintext.\n\nkmemdup() returns ZERO_SIZE_PTR for a zero-length allocation, so the\nunconditional sg_init_one() puts an invalid page into the scatterlist.\nWith CONFIG_DEBUG_SG this triggers a kernel BUG in sg_set_buf();\nwithout the debug check the bogus page is handed to the crypto backend.\n\nAES-SIV is defined for empty plaintext and the S2V result is then the\ncomplete output, so handle this case before the CTR step, which has\nnothing to encrypt.","summary":"A crafted (Re)Association Request with an empty FILS payload makes the mac80211 Wi-Fi code pass an invalid pointer to the crypto layer. The sources describe a kernel BUG with CONFIG_DEBUG_SG and mishandled memory without it, so the likely outcome is a crash or memory corruption.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kernel","linux","mac80211","self-hosted","wifi"],"not_affected_if":["no-mac80211","no-wifi"],"how_to_check":"- `uname -r` and compare against the fixed kernel builds in the NVD entry for CVE-2026-98698\n- `grep -i fils /proc/config.gz` or check the kernel config for `CONFIG_DEBUG_SG` (unknown whether the sources name a specific config gate)","fix":"- Update the Linux kernel to a release that includes the mac80211 FILS fix (fixed version unknown from the sources)\n- Until patched, unknown whether disabling FILS or a driver-side mitigation applies","status":"open","published_at":"2026-10-18T16:17:23+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:18:58+00:00","updated_at":"2026-10-25T05:18:58+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:18:58Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the mac80211 FILS fix (fixed version unknown from the sources)\n- Until patched, unknown whether disabling FILS or a driver-side mitigation applies","reach":"network","title":"Linux kernel: empty FILS association request can crash Wi-Fi stack","impact":"medium","summary":"A crafted (Re)Association Request with an empty FILS payload makes the mac80211 Wi-Fi code pass an invalid pointer to the crypto layer. The sources describe a kernel BUG with CONFIG_DEBUG_SG and mishandled memory without it, so the likely outcome is a crash or memory corruption.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","wifi","mac80211","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Kernel crash or memory corruption from a crafted Wi-Fi frame","analyst_note":"Find the fixed kernel versions and whether FILS must be enabled to trigger this, from the NVD entry or the upstream kernel commit.","how_to_check":"- `uname -r` and compare against the fixed kernel builds in the NVD entry for CVE-2026-98698\n- `grep -i fils /proc/config.gz` or check the kernel config for `CONFIG_DEBUG_SG` (unknown whether the sources name a specific config gate)","needs_analyst":true,"not_affected_if":["no-wifi","no-mac80211"],"who_is_affected":"Systems running a Linux kernel with the mac80211 Wi-Fi stack that handle FILS association, typically Wi-Fi access points or clients acting as access points in the association path. The sources do not say whether FILS must be enabled, so the exposure scope is unknown. Systems without Wi-Fi or without mac80211 are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000694,"input_tokens":3506,"output_tokens":687,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98698':15A,18A 'accept':99C 'ae':119C,179C 'aes-siv':178C 'alloc':138C 'assoc':97C 'associ':5A,30B,92C,102C 'backend':177C 'bogus':170C 'buf':164C 'bug':57B,160C 'call':123C 'case':198C 'check':168C 'code':43B 'complet':193C 'config':59B,153C 'corrupt':76B 'craft':28B 'crash':8A,73B 'crypt':113C 'crypto':50B,176C 'ctr':201C 'cve':13A,16A 'debug':60B,154C,167C 'defin':182C 'describ':54B 'element':107C,112C 'empti':3A,34B,90C,126C,184C 'encrypt':96C,121C,207C 'fi':11A,42B 'fil':4A,35B,91C,95C,110C 'follow':82C 'frame':104C 'hand':173C 'handl':89C,196C 'host':25B 'infrastructur':19B 'init':143C 'invalid':46B,147C 'kernel':2A,20B,56B,80C,159C 'kmemdup':128C 'last':106C 'layer':51B 'len':114C 'length':137C 'like':69B 'linux':1A,21B,79C 'mac80211':22B,39B,88C 'make':37B 'memori':64B,75B 'mishandl':63B 'noth':205C 'one':144C 'outcom':70B 'output':194C 'page':148C,171C 'pass':44B 'payload':36B,94C 'plaintext':127C,185C 'pointer':47B 'ptr':132C 'put':145C 're':29B,101C 'req':98C 'request':6A,31B,93C,103C 'resolv':86C 'result':189C 'return':129C 's2v':188C 'scatterlist':151C 'self':24B 'self-host':23B 'session':111C 'set':163C 'sg':61B,142C,155C,162C 'siv':120C,180C 'size':131C 'sourc':53B 'stack':12A 'step':202C 'trigger':157C 'uncondit':141C 'vulner':83C 'whose':105C 'wi':10A,41B 'wi-fi':9A,40B 'wifi':26B,87C 'without':65B,165C 'zero':117C,130C,136C 'zero-length':135C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the mac80211 Wi-Fi stack that handle FILS association, typically Wi-Fi access points or clients acting as access points in the association path. The sources do not say whether FILS must be enabled, so the exposure scope is unknown. Systems without Wi-Fi or without mac80211 are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:23+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98698","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98698","severity":null,"published_at":"2026-10-18T16:17:23+00:00","modified_at":"2026-10-21T13:21:37+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}