{"id":"CVE-2026-98874","kind":"vulnerability","aliases":["CVE-2026-98874"],"related":[],"title":"Linux kernel iwlwifi: spurious WARN on WoWLAN suspend without netdetect","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mld: don't WARN on WoWLAN suspend w/o netdetect\n\nClearly, from a user perspective, it must be valid to configure\nWoWLAN and then suspend while not connected to a network. Since\nmac80211 doesn't distinguish these cases and simply calls the\ndriver to suspend whenever WoWLAN is configured, the driver has\nto cleanly handle the case where it's called for WoWLAN, it's\nnot connected but there's also no netdetect configured.\n\nRemove the WARN_ON() and keep returning 1 to disconnect and\nthen suspend.","summary":"In the Linux kernel's iwlwifi MLD driver, suspending with WoWLAN configured but no network connection and no netdetect triggered a kernel WARN_ON. The fix removes the warning and keeps the existing disconnect-then-suspend behavior.","severity":"unknown","cvss":null,"epss":0.00198,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["iwlwifi","kernel","linux","runtime","wifi"],"not_affected_if":["non-intel-wifi","wowlan-unused"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-23T12:18:20+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T05:00:16+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-25T05:00:16Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel iwlwifi: spurious WARN on WoWLAN suspend without netdetect","impact":"low","summary":"In the Linux kernel's iwlwifi MLD driver, suspending with WoWLAN configured but no network connection and no netdetect triggered a kernel WARN_ON. The fix removes the warning and keeps the existing disconnect-then-suspend behavior.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","wifi","iwlwifi"],"confidence":0.4,"needs_auth":"no","worst_case":"Kernel logs a spurious warning during suspend; no code execution","analyst_note":"","how_to_check":"unknown","needs_analyst":false,"not_affected_if":["wowlan-unused","non-intel-wifi"],"who_is_affected":"Systems running Linux with an Intel wireless card driven by iwlwifi that use Wake-on-WLAN and suspend while disconnected. The sources describe a kernel warning, not a security compromise. unknown whether a fixed kernel version is listed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000556,"input_tokens":3445,"output_tokens":422,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98874':13A,16A '1':152C 'also':141C 'behavior':59B 'call':111C,131C 'case':108C,127C 'clean':124C 'clear':81C 'configur':33B,91C,119C,144C 'connect':37B,98C,137C 'cve':11A,14A 'disconnect':56B,154C 'disconnect-then-suspend':55B 'distinguish':106C 'doesn':104C 'driver':29B,113C,121C 'exist':54B 'fix':47B 'follow':65C 'handl':125C 'iwlwifi':3A,17B,27B,71C 'keep':52B,150C 'kernel':2A,18B,25B,43B,63C 'linux':1A,19B,24B,62C 'mac80211':103C 'mld':28B,72C 'must':87C 'netdetect':10A,40B,80C,143C 'network':36B,101C 'perspect':85C 'remov':48B,145C 'resolv':69C 'return':151C 'runtim':20B 'simpli':110C 'sinc':102C 'spurious':4A 'suspend':8A,30B,58B,78C,95C,115C,157C 'trigger':41B 'user':84C 'valid':89C 'vulner':66C 'w/o':79C 'warn':5A,44B,50B,75C,147C 'whenev':116C 'wifi':21B,70C 'without':9A 'wowlan':7A,32B,77C,92C,117C,133C","nicknames":[],"mitigations":[],"who_affected":"Systems running Linux with an Intel wireless card driven by iwlwifi that use Wake-on-WLAN and suspend while disconnected. The sources describe a kernel warning, not a security compromise. unknown whether a fixed kernel version is listed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T12:18:20+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98874","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98874","severity":null,"published_at":"2026-10-23T12:18:20+00:00","modified_at":"2026-10-23T12:18:20+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98874","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98874","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}