目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CVE-2026-98406— wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver

一分钟漏洞结论

影响对象
Linux Linux
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver ieee80211_set_bitrate_mask() checks if the interface is running via ieee80211_sdata_running(), but it does not check if

影响版本矩阵 18

厂商产品 版本范围状态
Linux Linux 554a43d5e77e8256aa9685ffd19ad555e6f77979< 4ba86c44b2fcb1c3175caa2456b6d58f483446ab affected
554a43d5e77e8256aa9685ffd19ad555e6f77979< 4095b66acae9893dd13deb39a4331651cb2f822b affected
554a43d5e77e8256aa9685ffd19ad555e6f77979< c2cd9c44777cf97be3e35c10b7c2d8f59ebb9306 affected
554a43d5e77e8256aa9685ffd19ad555e6f77979< 0d1700394e9f5d0bd9bebad8d5a50edf983f52fd affected
554a43d5e77e8256aa9685ffd19ad555e6f77979< 7978dda63d2b109ea9c3f7a096cd1aac6542cd54 affected
554a43d5e77e8256aa9685ffd19ad555e6f77979< 432c8532d5ccc2af77da43ed6ef1c80495a4efe8 affected
554a43d5e77e8256aa9685ffd19ad555e6f77979< c4ee5685af444024e6222ce29f6ed36adc44ffc3 affected
554a43d5e77e8256aa9685ffd19ad555e6f77979< da2ca406f45a6e21760243152ed8d2e8e72915c2 affected
… +10 条更多
获取后续新漏洞提醒 登录后订阅

一、 漏洞 CVE-2026-98406 基础信息

漏洞信息

Shenlong is analyzing...

对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗

尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。

Vulnerability Title
wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver
来源: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver ieee80211_set_bitrate_mask() checks if the interface is running via ieee80211_sdata_running(), but it does not check if the interface is still present in the driver. When sdata is running but IEEE80211_SDATA_IN_DRIVER is not set, the call reaches drv_set_bitrate_mask() in driver-ops.h which hits wlan1: Failed check-sdata-in-driver check, flags: 0x0 WARNING: net/mac80211/driver-ops.h:884 at drv_set_bitrate_mask Syzkaller triggers this via wext SIOCSIWRATE ioctl. The Call Trace shows wext_ioctl_dispatch() in wext-core.c dispatching the ioctl, calling ioctl_standard_call() for SIOCSIWRATE, which calls cfg80211_wext_siwrate() in wext-compat.c. That builds a bitrate mask and calls rdev_set_bitrate_mask() which ends up in ieee80211_set_bitrate_mask() in cfg.c. The interface is marked running via SDATA_STATE_RUNNING but flags is 0, so check_sdata_in_driver() fails. When the interface is being torn down, or when wext ioctl is issued during interface bringup before drv_add_interface() sets IN_DRIVER, the running check passes while IN_DRIVER is clear. Check IEEE80211_SDATA_IN_DRIVER in ieee80211_set_bitrate_mask() before calling the driver, returning -ENETDOWN. This avoids the WARN_ONCE in driver-ops.h and matches other cfg.c operations that bail early when not in driver. This change should be safe because wiphy mutex is held in cfg80211_wext_siwrate() via guard(wiphy), and IN_DRIVER is set/cleared under RTNL and wiphy paths in drv_add_interface() and drv_remove_interface() in driver-ops.c, so the check is race-free against driver add/remove. Returning -ENETDOWN is the same error other not-running paths use and does not introduce new locking. [also add second syzbot report]
来源: CVE Program / CVE List V5
CVSS Information
N/A
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5

受影响产品

厂商 产品 影响版本 CPE 订阅
Linux Linux 554a43d5e77e8256aa9685ffd19ad555e6f77979 ~ 4ba86c44b2fcb1c3175caa2456b6d58f483446ab -
Linux Linux 3.5 -

二、漏洞 CVE-2026-98406 的公开POC

# POC 描述 源链接 神龙链接
AI 生成 POC 高级

未找到公开 POC。

登录以生成 AI POC

三、漏洞 CVE-2026-98406 的情报信息

请登录查看更多情报信息。

CVE-2026-98406 其他参考 (8)

同批安全公告 · Linux · 2026-10-14 · 共 46 条

CVE-2026-98398 locking/lockdep: Invalidate stale class_cache entries for zapped classes
CVE-2026-98396 powerpc: Do not restore KUAP in arch_exit_to_user_mode_prepare()
CVE-2026-98393 net: ipv4: Fix UDP length overflow with PMTU discover and big MTU
CVE-2026-98391 drm/xe: Guard page-fault worker with runtime PM check
CVE-2026-98389 drm/amdgpu: skip gfx switch_power_profile during GPU reset
CVE-2026-98388 exec: do_close_on_exec() before taking exec_update_lock
CVE-2026-98387 s390/crypto: Fix skcipher_walk return code handling in aes_s390
CVE-2026-98386 scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot
CVE-2026-98390 x86/amd_node: Avoid divide by zero on virtualized systems
CVE-2026-98397 platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown
CVE-2026-98395 powerpc/entry: Fix irq_soft_mask corruption on replayed interrupt exit
CVE-2026-98399 s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block
CVE-2026-98400 s390/ipl: Fix NULL deref in kdump without re-IPL parm block
CVE-2026-98402 net: icmp: avoid invalid transport header access in icmp_send tracepoint
CVE-2026-98401 net: iptunnel: fix stale transport header during tunnel decapsulation
CVE-2026-98403 s390/boot: Avoid IPL parameter append past command line
CVE-2026-98404 drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()
CVE-2026-98405 smb: client: fix missing iov bounds check in parse_posix_sids()
CVE-2026-98408 watchdog: rzv2h: Avoid division by zero
CVE-2026-98407 wifi: rsi: fix heap OOB write on key removal

显示前 20 条，共 46 条。 查看全部 &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-98406

暂无评论

发表评论