SB20261022307 - Use of Uninitialized Variable in Linux kernel mac80211

Description

This security bulletin contains information about 1 vulnerability.

1) Use of Uninitialized Variable (CVE-ID: CVE-2026-98702)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker on the local network to cause a denial of service by triggering a kernel panic.

The vulnerability exists due to use of an uninitialized variable in the Linux kernel mac80211 HT/VHT channel definition validator when processing a channel switch announcement frame indicating 320 MHz bandwidth on a non-6 GHz link. A remote attacker on the local network can send a specially crafted frame to trigger a warning and subsequent use of the uninitialized vht_operation.chan_width value by ieee80211_chandef_vht_oper(), causing a kernel panic under the configuration described below.

The kernel panic requires panic_on_warn to be enabled.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1892e71aa2e5ee667d87c6e49e3661f5e290303b
• https://git.kernel.org/stable/c/56e236759f0a8dc910c2ae7cd3c161f298ee5794
• https://git.kernel.org/stable/c/79b3ce0d881cd6e5d4d3496b19f5cc5e7089a56c
• https://git.kernel.org/stable/c/cf0ddacce173890407ed3fa50c8ea9b3c0cc0e16