Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-98406— wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，已修复以下漏洞： wifi: mac80211: 当 sdata 不在驱动中时，避免在 中出现 WARN 警告 通过 检查接口是否处于运行状态，但它并未检查该接口是否仍存在于驱动程序中。 当 sdata（软件定义接口数据结构）处于运行状态，但尚未设置 标志时，调用会进入 中的 ，从而触发以下警告： Syzkaller 工具通过 wext 的 ioctl 触发此问题。调用栈显示， 中的 分发该 ioctl，调用 处理 ，后者进而调用 中的 。该函数构建速率掩码并调用 ，最终进入 中的 。此时，

AI Predicted 3.7 Difficulty: Moderate

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 554a43d5e77e8256aa9685ffd19ad555e6f77979< 4ba86c44b2fcb1c3175caa2456b6d58f483446ab affected
554a43d5e77e8256aa9685ffd19ad555e6f77979< 4095b66acae9893dd13deb39a4331651cb2f822b affected
554a43d5e77e8256aa9685ffd19ad555e6f77979< c2cd9c44777cf97be3e35c10b7c2d8f59ebb9306 affected
554a43d5e77e8256aa9685ffd19ad555e6f77979< 0d1700394e9f5d0bd9bebad8d5a50edf983f52fd affected
554a43d5e77e8256aa9685ffd19ad555e6f77979< 7978dda63d2b109ea9c3f7a096cd1aac6542cd54 affected
554a43d5e77e8256aa9685ffd19ad555e6f77979< 432c8532d5ccc2af77da43ed6ef1c80495a4efe8 affected
554a43d5e77e8256aa9685ffd19ad555e6f77979< c4ee5685af444024e6222ce29f6ed36adc44ffc3 affected
554a43d5e77e8256aa9685ffd19ad555e6f77979< da2ca406f45a6e21760243152ed8d2e8e72915c2 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-98406

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver ieee80211_set_bitrate_mask() checks if the interface is running via ieee80211_sdata_running(), but it does not check if the interface is still present in the driver. When sdata is running but IEEE80211_SDATA_IN_DRIVER is not set, the call reaches drv_set_bitrate_mask() in driver-ops.h which hits wlan1: Failed check-sdata-in-driver check, flags: 0x0 WARNING: net/mac80211/driver-ops.h:884 at drv_set_bitrate_mask Syzkaller triggers this via wext SIOCSIWRATE ioctl. The Call Trace shows wext_ioctl_dispatch() in wext-core.c dispatching the ioctl, calling ioctl_standard_call() for SIOCSIWRATE, which calls cfg80211_wext_siwrate() in wext-compat.c. That builds a bitrate mask and calls rdev_set_bitrate_mask() which ends up in ieee80211_set_bitrate_mask() in cfg.c. The interface is marked running via SDATA_STATE_RUNNING but flags is 0, so check_sdata_in_driver() fails. When the interface is being torn down, or when wext ioctl is issued during interface bringup before drv_add_interface() sets IN_DRIVER, the running check passes while IN_DRIVER is clear. Check IEEE80211_SDATA_IN_DRIVER in ieee80211_set_bitrate_mask() before calling the driver, returning -ENETDOWN. This avoids the WARN_ONCE in driver-ops.h and matches other cfg.c operations that bail early when not in driver. This change should be safe because wiphy mutex is held in cfg80211_wext_siwrate() via guard(wiphy), and IN_DRIVER is set/cleared under RTNL and wiphy paths in drv_add_interface() and drv_remove_interface() in driver-ops.c, so the check is race-free against driver add/remove. Returning -ENETDOWN is the same error other not-running paths use and does not introduce new locking. [also add second syzbot report]
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 554a43d5e77e8256aa9685ffd19ad555e6f77979 ~ 4ba86c44b2fcb1c3175caa2456b6d58f483446ab -
Linux Linux 3.5 -

II. Public POCs for CVE-2026-98406

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-98406

请登录查看更多情报信息。

Other References for CVE-2026-98406 (8)

Same Patch Batch · Linux · 2026-10-14 · 46 CVEs total

CVE-2026-98398 locking/lockdep: Invalidate stale class_cache entries for zapped classes
CVE-2026-98396 powerpc: Do not restore KUAP in arch_exit_to_user_mode_prepare()
CVE-2026-98393 net: ipv4: Fix UDP length overflow with PMTU discover and big MTU
CVE-2026-98391 drm/xe: Guard page-fault worker with runtime PM check
CVE-2026-98389 drm/amdgpu: skip gfx switch_power_profile during GPU reset
CVE-2026-98388 exec: do_close_on_exec() before taking exec_update_lock
CVE-2026-98387 s390/crypto: Fix skcipher_walk return code handling in aes_s390
CVE-2026-98386 scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot
CVE-2026-98390 x86/amd_node: Avoid divide by zero on virtualized systems
CVE-2026-98397 platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown
CVE-2026-98395 powerpc/entry: Fix irq_soft_mask corruption on replayed interrupt exit
CVE-2026-98399 s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block
CVE-2026-98400 s390/ipl: Fix NULL deref in kdump without re-IPL parm block
CVE-2026-98402 net: icmp: avoid invalid transport header access in icmp_send tracepoint
CVE-2026-98401 net: iptunnel: fix stale transport header during tunnel decapsulation
CVE-2026-98403 s390/boot: Avoid IPL parameter append past command line
CVE-2026-98404 drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()
CVE-2026-98405 smb: client: fix missing iov bounds check in parse_posix_sids()
CVE-2026-98408 watchdog: rzv2h: Avoid division by zero
CVE-2026-98407 wifi: rsi: fix heap OOB write on key removal

Showing top 20 of 46 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-98406

No comments yet

Leave a comment