{"id":"CVE-2026-98891","kind":"vulnerability","aliases":["CVE-2026-98891"],"related":[],"title":"Linux kernel: wifi deauth frame read before length check","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: validate deauth frame length before reason access\n\nieee80211_rx_mgmt_deauth() reads the deauth reason code before checking\nthat the fixed field is actually present in the received frame.\n\nValidate the deauth frame length first and only then read the reason\ncode.","summary":"The mac80211 Wi-Fi stack in the Linux kernel reads a deauthentication frame's reason code before confirming the frame is long enough to contain it. A malformed deauth frame received over the air can therefore cause an out-of-bounds read, with the sources not describing the resulting impact beyond that.","severity":"unknown","cvss":null,"epss":0.00215,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-kernel","mac80211","self-hosted","wifi"],"not_affected_if":["no-wifi-hardware"],"how_to_check":"- unknown","fix":"- Update the Linux kernel to a release that includes the mac80211 deauth length validation fix; the sources do not name the fixed version.","status":"open","published_at":"2026-10-23T12:18:22+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T05:00:01+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T05:00:01Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the mac80211 deauth length validation fix; the sources do not name the fixed version.","reach":"network","title":"Linux kernel: wifi deauth frame read before length check","impact":"low","summary":"The mac80211 Wi-Fi stack in the Linux kernel reads a deauthentication frame's reason code before confirming the frame is long enough to contain it. A malformed deauth frame received over the air can therefore cause an out-of-bounds read, with the sources not describing the resulting impact beyond that.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","wifi","mac80211","self-hosted"],"confidence":0.4,"needs_auth":"no","worst_case":"unknown; the sources do not state the impact beyond an out-of-bounds read","analyst_note":"Find the NVD entry or kernel.org commit for CVE-2026-98891 to confirm affected and fixed kernel versions and the actual impact.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-wifi-hardware"],"who_is_affected":"Systems running a Linux kernel with mac80211 Wi-Fi support and an active wireless interface are the ones to look at, since the frame arrives over the air. Machines without Wi-Fi hardware or with Wi-Fi disabled are unlikely to be exposed. The sources do not say which kernel versions are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000602,"input_tokens":3326,"output_tokens":538,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-98891':12A,15A 'access':96C 'actual':113C 'air':59B 'beyond':77B 'bound':67B 'caus':62B 'check':9A,107C 'code':41B,105C,131C 'confirm':43B 'contain':50B 'cve':10A,13A 'deauth':4A,54B,91C,100C,103C,121C 'deauthent':37B 'describ':73B 'enough':48B 'fi':29B 'field':111C 'first':124C 'fix':110C 'follow':83C 'frame':5A,38B,45B,55B,92C,118C,122C 'host':23B 'ieee80211':97C 'impact':76B 'infrastructur':16B 'kernel':2A,19B,34B,81C 'length':8A,93C,123C 'linux':1A,18B,33B,80C 'linux-kernel':17B 'long':47B 'mac80211':20B,26B,89C 'malform':53B 'mgmt':99C 'out-of-bound':64B 'present':114C 'read':6A,35B,68B,101C,128C 'reason':40B,95C,104C,130C 'receiv':56B,117C 'resolv':87C 'result':75B 'rx':98C 'self':22B 'self-host':21B 'sourc':71B 'stack':30B 'therefor':61B 'valid':90C,119C 'vulner':84C 'wi':28B 'wi-fi':27B 'wifi':3A,24B,88C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with mac80211 Wi-Fi support and an active wireless interface are the ones to look at, since the frame arrives over the air. Machines without Wi-Fi hardware or with Wi-Fi disabled are unlikely to be exposed. The sources do not say which kernel versions are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T12:18:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98891","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98891","severity":null,"published_at":"2026-10-23T12:18:22+00:00","modified_at":"2026-10-23T12:18:22+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98891","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98891","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}