Live › vulnerability › CVE-2026-98702
Go to dashboardA malformed 320 MHz channel switch announcement in a received Wi-Fi frame, on a link that does not support that width, leaves a value uninitialized in the mac80211 wireless stack. With panic_on_warn enabled, a nearby device sending that frame can crash the kernel.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Machines running a Linux kernel with mac80211 Wi-Fi support, reachable by radio from an attacker in range. Systems that do not use Wi-Fi through mac80211, or that keep panic_on_warn disabled, are unlikely to crash from this frame; the sources do not say whether a non-panic path has other effects.
No product ranges from the sources yet.
uname -r and compare with the fixed kernel versions in the upstream commit, which the sources do not list.panic_on_warn is set: sysctl kernel.panic_on_warn (unknown whether default configs enable it).lsmod | grep mac80211.kernel.panic_on_warn at 0 if the machine does not need it.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: reject invalid 320 MHz CSA bandwidth
The HT/VHT channel definition validator can receive a 320 MHz bandwidth indication from a received CSA frame on a non-6 GHz link. It warns for this unsupported width but continues with an uninitialized vht_operation.chan_width, which is then read by ieee80211_chandef_vht_oper(). With panic_on_warn enabled, this lets a received frame panic the kernel.
Reject the channel definition before entering the VHT operation conversion. This preserves the existing CSA fallback while avoiding both the warning and the uninitialized read.
This page as .md · .json · in your agent: get_signal("CVE-2026-98702")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.