SB2026100737 - Improper input validation in Linux kernel mac80211

Description

This security bulletin contains information about 1 vulnerability.

1) Improper input validation (CVE-ID: CVE-2026-98329)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to insufficient validation of requested transmission bandwidth in mac80211 radiotap parsing when processing frames injected through a monitor interface. A local user can inject a frame with a radiotap field requesting bandwidth wider than the operational channel bandwidth to trigger a kernel warning.

The reported warning occurs in hwsim when the requested bandwidth is passed to the driver.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/73f48f7e16cadfc74f444ccd10c1d3ae253e2e27
• https://git.kernel.org/stable/c/a5c715eda066cba5ce3372759188ba8636dca629
• https://git.kernel.org/stable/c/c69718519a81e87284494d0c6e6eb7bdd834707a
• https://git.kernel.org/stable/c/e14bf37bb2b3853012ff160131d1c6233f7a9cc9