Improper Check for Unusual or Exceptional Conditions in Linux kernel - CVE-2026-98406

Vulnerability details

The vulnerability allows a local user to trigger a kernel warning.

The vulnerability exists due to insufficient validation of the interface's driver-presence state in ieee80211_set_bitrate_mask() when handling wireless bitrate-setting requests. A local user can issue a SIOCSIWRATE ioctl for an interface marked as running but absent from the driver to trigger a kernel warning.

The affected state can occur during interface teardown or during bringup before the interface is added to the driver.

Affected software

How to mitigate CVE-2026-98406

External References

• https://git.kernel.org/stable/c/0d1700394e9f5d0bd9bebad8d5a50edf983f52fd
• https://git.kernel.org/stable/c/4095b66acae9893dd13deb39a4331651cb2f822b
• https://git.kernel.org/stable/c/432c8532d5ccc2af77da43ed6ef1c80495a4efe8
• https://git.kernel.org/stable/c/4ba86c44b2fcb1c3175caa2456b6d58f483446ab
• https://git.kernel.org/stable/c/7978dda63d2b109ea9c3f7a096cd1aac6542cd54
• https://git.kernel.org/stable/c/c2cd9c44777cf97be3e35c10b7c2d8f59ebb9306
• https://git.kernel.org/stable/c/c4ee5685af444024e6222ce29f6ed36adc44ffc3
• https://git.kernel.org/stable/c/da2ca406f45a6e21760243152ed8d2e8e72915c2

Related Security Bulletins

• Improper Check for Unusual or Exceptional Conditions in Linux kernel mac80211
• Debian update for linux