CVE-2026-98182

A flaw was found in the Linux kernel's mac80211 wireless subsystem. A local user with network administration privileges can cause a Denial of Service (DoS) by configuring an inactive network interface to active monitor mode and then bringing the interface up. Because the required transmit queue is not allocated when the flag is set on a down interface, the wireless driver triggers a null pointer dereference, leading to a kernel crash.

A low impact flaw was found in the Linux kernel's mac80211 wireless subsystem. A local user with CAP_NET_ADMIN (network administration) privileges can cause a denial of service by setting an inactive monitor interface to active monitor mode (for example, via "iw dev X set monitor active") and then bringing the interface up. A monitor interface only receives a transmit queue (TXQ) if it is created active, and a queue cannot be added later, so when the active flag is set on a down interface the wireless driver is handed a monitor with no queue; drivers such as ath9k dereference the missing queue, resulting in a NULL pointer dereference and a kernel crash. Red Hat Enterprise Linux 8, 9, and 10 (kernel and kernel-rt), Red Hat In-Vehicle OS, and OpenShift Container Platform (RHEL CoreOS) are affected because the vulnerable code is present in those streams; Red Hat Enterprise Linux 7 is not affected because the vulnerable code is not present there. Fixes for the affected streams are currently deferred given the low severity of this flaw, so the residual risk is that an attacker who already holds local network administration privileges on a host with an affected wireless driver can crash the kernel. Red Hat rates the overall impact of this flaw as Low because triggering it requires significant local privileges (CAP_NET_ADMIN) and the consequence is limited to system availability, with no impact on confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.