CVE-2026-90344

A flaw was found in the Linux kernel's mac80211 wireless subsystem. A remote attacker, operating a malicious Access Point (AP), could exploit this by sending a Channel Switch Announcement (CSA) to an invalid channel, specifically channel zero. Due to an error in parsing the CSA, the system fails to disconnect as it should. This can lead to a firmware crash on Intel wireless devices, resulting in a Denial of Service (DoS).

A moderate severity denial-of-service flaw was found in the Linux kernel's mac80211 wireless subsystem. A refactoring error in the Channel Switch Announcement (CSA) parsing code erroneously treats channel 0 as if no channel information were present, so when an Access Point advertises a channel switch to that invalid channel, the affected system fails to disconnect as it should. An attacker who controls or has compromised an Access Point within wireless range of a victim can exploit this behavior; on systems using Intel wireless devices this can crash the wireless firmware, resulting in loss of wireless network connectivity until the wireless subsystem or the system is restarted. There is no impact on confidentiality or integrity.

This issue affects the kernel and kernel-rt packages in Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS 2, and the RHEL CoreOS 9-based nodes of OpenShift Container Platform 4 and 5. Red Hat Enterprise Linux 7 and 8, earlier Red Hat Enterprise Linux 9 update streams, and earlier OpenShift Container Platform 4 versions are not affected because the vulnerable code is not present in those kernels.

The fix is deferred for the affected streams because the flaw is a moderate-impact denial of service with no confidentiality or integrity impact, exploitation requires an attacker to control or compromise an Access Point on the victim's wireless network, and recovery is possible by restarting the wireless subsystem or the system. The residual risk is therefore limited to a temporary loss of wireless connectivity, primarily on systems with Intel wireless hardware. Although the flaw is reachable over the local wireless network, Red Hat rates the overall severity as moderate, reflecting the limited and recoverable denial-of-service impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.