Improper input validation in Linux kernel - CVE-2026-98329

Vulnerability details

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to insufficient validation of requested transmission bandwidth in mac80211 radiotap parsing when processing frames injected through a monitor interface. A local user can inject a frame with a radiotap field requesting bandwidth wider than the operational channel bandwidth to trigger a kernel warning.

The reported warning occurs in hwsim when the requested bandwidth is passed to the driver.

Affected software

How to mitigate CVE-2026-98329

External References

• https://git.kernel.org/stable/c/73f48f7e16cadfc74f444ccd10c1d3ae253e2e27
• https://git.kernel.org/stable/c/a5c715eda066cba5ce3372759188ba8636dca629
• https://git.kernel.org/stable/c/c69718519a81e87284494d0c6e6eb7bdd834707a
• https://git.kernel.org/stable/c/e14bf37bb2b3853012ff160131d1c6233f7a9cc9

Related Security Bulletins

• Improper input validation in Linux kernel mac80211
• Debian update for linux