Race condition in Linux kernel - CVE-2026-98337

Vulnerability details

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to a race condition in __ieee80211_roc_work() in net/mac80211/offchannel.c when processing remain-on-channel work concurrently with a wireless scan. A local user can cause a remain-on-channel operation to start during a scan to trigger a kernel warning.

The problematic sequence involves pending remain-on-channel work, an initially empty remain-on-channel list, and a newly queued operation. The warning occurs in ieee80211_start_next_roc().

Affected software

How to mitigate CVE-2026-98337

External References

• https://git.kernel.org/stable/c/58b806f699052c572dec6cab2c376f884f27e98f
• https://git.kernel.org/stable/c/5dc8ec2f8d1d62914661577c23ec151f5c9734a4
• https://git.kernel.org/stable/c/733f0fde95392ed5f61a4e36aee661ea8d0e8581
• https://git.kernel.org/stable/c/81baab8b645ec532bad2b7a8464191c720ef8fd9

Related Security Bulletins

• Race condition in Linux kernel mac80211
• Debian update for linux