CVE-2026-97518

A flaw was found in the Linux kernel's cfg80211 wireless configuration subsystem. The subsystem fails to reject duplicate cipher suite entries during wireless device registration. This flaw allows a local user to cause an array buffer overflow within the Wireless Extensions (WEXT) compatibility layer, leading to memory corruption and a Denial of Service (DoS) via a system crash.

A moderate severity flaw was found in the Linux kernel's cfg80211 wireless configuration subsystem as shipped in Red Hat Enterprise Linux (including the kernel-rt variant), Red Hat In-Vehicle OS, and the RHEL CoreOS images used by OpenShift Container Platform. The cfg80211 subsystem did not reject duplicate cipher suite entries supplied by a wireless driver when registering a wiphy device. In the Wireless Extensions (WEXT) compatibility layer, the SIOCGIWRANGE ioctl appends a WEP key length for each WEP cipher suite entry it encounters, so repeated WEP entries can overflow the fixed iw_range::encoding_size array, resulting in kernel memory corruption and a denial of service via a system crash. A local user who queries wireless capabilities through this ioctl can trigger the overflow; however, exploitation requires a wireless driver that registers a malformed wiphy description containing duplicate cipher suites, which limits practical exposure, and Red Hat rates this flaw Moderate (CVSS 3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The fix is currently deferred for the affected Red Hat products: the flaw is not remotely reachable and requires an unusual malformed driver configuration, so it will be addressed in a future scheduled update rather than an immediate erratum. The residual risk until the fix is delivered is local denial of service or memory corruption on systems where an affected wireless driver is loaded.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.