Live › vulnerability › CVE-2026-98891
Go to dashboardThe mac80211 Wi-Fi stack in the Linux kernel reads a deauthentication frame's reason code before confirming the frame is long enough to contain it. A malformed deauth frame received over the air can therefore cause an out-of-bounds read, with the sources not describing the resulting impact beyond that.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with mac80211 Wi-Fi support and an active wireless interface are the ones to look at, since the frame arrives over the air. Machines without Wi-Fi hardware or with Wi-Fi disabled are unlikely to be exposed. The sources do not say which kernel versions are affected.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: validate deauth frame length before reason access
ieee80211_rx_mgmt_deauth() reads the deauth reason code before checking that the fixed field is actually present in the received frame.
Validate the deauth frame length first and only then read the reason code.
This page as .md · .json · in your agent: get_signal("CVE-2026-98891")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.