Incorrect Calculation of Buffer Size in Linux kernel - CVE-2026-98328
Published: October 7, 2026
Vulnerability identifier: #VU153691
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98328
CWE-ID: CWE-131
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to disrupt wireless scanning.
The vulnerability exists due to incorrect calculation of the probe request element buffer size in the mac80211 wireless subsystem when building probe request elements. A local user can initiate a wireless scan to disrupt wireless scanning.
The issue requires hardware support for 6 GHz. The HE 6 GHz Band Capability element is included in probe requests for every band when this support is present.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-98328
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.113-1
linux (Debian package) - update to 6.12.113-1
External References
- https://git.kernel.org/stable/c/8659bd6c4c852096b6621086d1ea38eed84b454a
- https://git.kernel.org/stable/c/9d83c08dcce808c732988a5291e3ef4f59d09edb
- https://git.kernel.org/stable/c/ad5bd0f6a0c337a80c141ea8e6c7a1d9c145be79
- https://git.kernel.org/stable/c/be7bfdea1ec9b672a80c736bd6ed932e1adebef8
- https://git.kernel.org/stable/c/cd54bf333f5631d3630bab0a832e9ae648f73515
- https://git.kernel.org/stable/c/db19d5414227d86cee77a000607a6710d7f36853