Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-98340— wifi: cfg80211: only group hidden BSSes with beacon entries

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，已解决以下漏洞： wifi: cfg80211：仅在存在信标（beacon）条目的情况下才将隐藏 BSS 进行组合 当收到未知 BSS（基本服务集）的探测响应（probe response）时， 会查找现有条目中 BSSID 相同且 SSID 为隐藏状态（即长度为零或由 NUL 字符填充）的条目；如果找到，则将该新条目与现有条目归为一组，并采用现有条目中的信标信息元素（IE）。 然而，如果该新条目本身也是来自探测响应（且包含 SSID），则可能找到另一个没有信标条目的现有条目，从而导致形成一

AI Predicted 3.7 Difficulty: Theoretical EPSS 0.18% · P7

Possible ATT&CK Techniques 1 AI

T1059 · Command and Scripting Interpreter

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 4593c4cbe1c96b3995727dc42f6aa103f4ff5afc< 4cd6a518ce7527284bbc9baab5fa2453a7d477c2 affected
4593c4cbe1c96b3995727dc42f6aa103f4ff5afc< 74ed0d992f392c75e1969415527e06df3f7a4034 affected
4593c4cbe1c96b3995727dc42f6aa103f4ff5afc< 3658093df69849daf4f813a8f087f358e13be203 affected
4593c4cbe1c96b3995727dc42f6aa103f4ff5afc< 73365b81630b57e1a1f9d50dc87281797855c2ac affected
4593c4cbe1c96b3995727dc42f6aa103f4ff5afc< 7405dd19bda4537a2843637d8d7bed1efd4776cf affected
4593c4cbe1c96b3995727dc42f6aa103f4ff5afc< 86235be788094131912e9bd8412b358d91d99f49 affected
4593c4cbe1c96b3995727dc42f6aa103f4ff5afc< 332ea1502c46f53375cb109fa82bfaff818f3a41 affected
4593c4cbe1c96b3995727dc42f6aa103f4ff5afc< 068843ed0902c552a13860c5ec6b2ca65b57a065 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-98340

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
wifi: cfg80211: only group hidden BSSes with beacon entries
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: only group hidden BSSes with beacon entries When a probe response for an unknown BSS comes in, __cfg80211_bss_update() looks for an existing entry with the same BSSID and a hidden (zero-length or NUL-filled) SSID, and if it finds one it groups them, using the beacon IEs from the existing entry. But that could find another entry without a beacon, if it was also from a probe response (with SSID), so there's a group without beacon elements. If a beacon with a hidden SSID for that BSSID arrives later, cfg80211_combine_bsses() goes looking for the probe response entries that belong to it - i.e. entries with the same BSSID and channel that have no beacon IEs - and finds those two. They are already grouped with each other, so it hits its WARN_ON_ONCE(bss->pub.hidden_beacon_bss) WARN_ON_ONCE(!list_empty(&bss->hidden_list)) which are there because an entry without beacon elements is not supposed to be part of a group yet. Only combine entries when a beacon was already received, ones that are kept separate will be combined when a beacon arrives.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 4593c4cbe1c96b3995727dc42f6aa103f4ff5afc ~ 4cd6a518ce7527284bbc9baab5fa2453a7d477c2 -
Linux Linux 3.9 -

II. Public POCs for CVE-2026-98340

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-98340

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-98340 (8)

Same Patch Batch · Linux · 2026-10-06 · 208 CVEs total

CVE-2026-98323 9.8 CRITICAL RDMA/siw: Bound fragmented header copies by the remaining length
CVE-2026-98365 9.8 CRITICAL RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access
CVE-2026-98282 8.8 HIGH powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba
CVE-2026-98283 8.8 HIGH KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()
CVE-2026-98339 8.8 HIGH wifi: cfg80211: don't filter by BSS type when removing stale entries
CVE-2026-98171 8.8 HIGH smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs
CVE-2026-98261 8.1 HIGH cifs: Fix server use-after-free in cifs_chan_skip_or_disable()
CVE-2026-98357 8.1 HIGH IB/isert: wait for deferred control PDU completions before releasing the connection
CVE-2026-98239 8.1 HIGH net: lan743x: fix RX checksum use-after-free
CVE-2026-98341 7.8 HIGH wifi: cfg80211: don't free driver-owned scan requests
CVE-2026-98281 7.8 HIGH futex: Also allocate private hash on vfork()
CVE-2026-98324 7.8 HIGH dmaengine: pxa: fix double counting of the hw descriptors
CVE-2026-98320 7.8 HIGH netfilter: flowtable: hold reference on ct until flow is released
CVE-2026-98228 7.8 HIGH mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ
CVE-2026-98229 7.8 HIGH xfrm: save input state data before secpath resets
CVE-2026-98318 7.8 HIGH smb: client: validate absolute native symlink targets before NT fixups
CVE-2026-98315 7.8 HIGH ntfs: protect runlist updates with the runlist lock
CVE-2026-98260 7.8 HIGH exec: Cleanup POSIX timers right after de_thread()
CVE-2026-98256 7.8 HIGH signal: Prevent exec() race
CVE-2026-98258 7.8 HIGH posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list

Showing top 20 of 208 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-98340

No comments yet

Leave a comment