CVE-2026-98334
wifi: mac80211: reset state when starting AP fails
No known exploitation. EPSS puts it in the 7th percentile. Fixed versions are out.
What to do
Find your product and version, then upgrade to the build on the right.
- LinuxAffected: ≥ d6a83228823fc0cc8d79d95c9f0bf568b7317862, < d83da43e9b3b3b1bad99ac5a1065f1c63ad5fc32Upgrade to: d83da43e9b3b3b1bad99ac5a1065f1c63ad5fc32Affected: ≥ d6a83228823fc0cc8d79d95c9f0bf568b7317862, < 5d5ff5b36f5748a2a077f875a73ccb26860d3fccUpgrade to: 5d5ff5b36f5748a2a077f875a73ccb26860d3fccAffected: ≥ d6a83228823fc0cc8d79d95c9f0bf568b7317862, < 6eac225f59c1c2277ac74f8a716d6df0ba3b8d28Upgrade to: 6eac225f59c1c2277ac74f8a716d6df0ba3b8d28Affected: ≥ d6a83228823fc0cc8d79d95c9f0bf568b7317862, < 3f28551d0241254a75626d868041c6340285088bUpgrade to: 3f28551d0241254a75626d868041c6340285088bStated by: CVE record
Versions as the sources state them. Full version matrix after sign-in
What it is
From the CVE record
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reset state when starting AP fails ieee80211_start_ap() can set enable_beacon (and beacon_int) and fail later, leaving it set forever. Scanning can then attempt to restore beaconing on such an interface, leading to: Oops: divide error: 0000 [#1] SMP KASAN NOPTI RIP: 0010:mac80211_hwsim_link_info_changed+0xca7/0xf00 Call Trace: drv_link_info_changed+0x413/0x860 net/mac80211/driver-ops.c:495 ieee80211_link_info_change_notify+0x24b/0x3c0 net/mac80211/main.c:427 ieee80211_offchannel_return+0x381/0x580 net/mac80211/offchannel.c:160 __ieee80211_scan_completed+0x993/0xe30 net/mac80211/scan.c:519 ieee80211_scan_work+0x472/0x2010 net/mac80211/scan.c:1193 cfg80211_wiphy_work+0x2b7/0x550 net/wireless/core.c:538 in hwsim. Also, cfg80211 then allows changing the interface type, and the off-channel path getgs confused about beaconing as well, leading to another warning: WARNING: net/mac80211/driver-ops.c:468 at drv_link_info_changed+0x583/0x880 ieee80211_link_info_change_notify+0x24b/0x3c0 net/mac80211/main.c:427 ieee80211_offchannel_stop_vifs+0x328/0x5c0 net/mac80211/offchannel.c:122 ieee80211_start_sw_scan net/mac80211/scan.c:583 [inline] __ieee80211_start_scan+0xfb6/0x1af0 net/mac80211/scan.c:882 Reset the state on failures to always have it correct.
In plain language
No plain-language summary for this CVE yet.
Exploitation
Where each signal puts this CVE on the scale from published to confirmed exploited.
- CISA KEV
Not in the catalog. CISA has not confirmed exploitation.
- Public exploits
No public exploit or proof of concept found in the sources we track.
- EPSS
0.2% chance of exploitation activity in the next 30 days, which ranks it in the 7th percentile of scored CVEs.
Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.
Lifecycle
2 events over 0 days, from the signal feeds we watch.
- Publishedrecord updated
Affected products
Sources
References in the record
- git.kernel.org/stable/c/3f28551d0241254a75626d868041c6340285088b
- git.kernel.org/stable/c/5d5ff5b36f5748a2a077f875a73ccb26860d3fcc
- git.kernel.org/stable/c/6eac225f59c1c2277ac74f8a716d6df0ba3b8d28
And 1 more reference. See all after sign-in
In the news
Watch the software you run.
My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.
We'll flag the next CVE, public exploit or patch for Linux, not every advisory.
A free account adds
- The full version matrix and every affected product
- Exploit links, proofs of concept and Metasploit modules
- Email alerts for the products you watch
- The same data over REST API, MCP and CLI