---
id: "CVE-2026-98891"
kind: "vulnerability"
aliases: ["CVE-2026-98891"]
title: "Linux kernel: wifi deauth frame read before length check"
severity: "unknown"
cvss: null
epss: 0.00215
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "linux-kernel", "mac80211", "self-hosted", "wifi"]
not_affected_if: ["no-wifi-hardware"]
published_at: "2026-10-23T12:18:22+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98891", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-98891", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# Linux kernel: wifi deauth frame read before length check

The mac80211 Wi-Fi stack in the Linux kernel reads a deauthentication frame's reason code before confirming the frame is long enough to contain it. A malformed deauth frame received over the air can therefore cause an out-of-bounds read, with the sources not describing the resulting impact beyond that.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- Update the Linux kernel to a release that includes the mac80211 deauth length validation fix; the sources do not name the fixed version.

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98891
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-98891

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: validate deauth frame length before reason access

ieee80211_rx_mgmt_deauth() reads the deauth reason code before checking
that the fixed field is actually present in the received frame.

Validate the deauth frame length first and only then read the reason
code.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_