SB2026100731 - Race condition in Linux kernel mac80211

Description

This security bulletin contains information about 1 vulnerability.

1) Race condition (CVE-ID: CVE-2026-98337)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to a race condition in __ieee80211_roc_work() in net/mac80211/offchannel.c when processing remain-on-channel work concurrently with a wireless scan. A local user can cause a remain-on-channel operation to start during a scan to trigger a kernel warning.

The problematic sequence involves pending remain-on-channel work, an initially empty remain-on-channel list, and a newly queued operation. The warning occurs in ieee80211_start_next_roc().

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/58b806f699052c572dec6cab2c376f884f27e98f
• https://git.kernel.org/stable/c/5dc8ec2f8d1d62914661577c23ec151f5c9734a4
• https://git.kernel.org/stable/c/733f0fde95392ed5f61a4e36aee661ea8d0e8581
• https://git.kernel.org/stable/c/81baab8b645ec532bad2b7a8464191c720ef8fd9