CVE-2026-98328

A flaw was found in the Linux kernel's mac80211 wireless subsystem. This flaw allows a local user to cause a Denial of Service (DoS) by initiating a wireless scan on a device supporting 6 GHz High Efficiency (HE) bands. Because the kernel fails to account for the HE 6 GHz capability element when calculating the required scan element length, probe request generation fails and triggers a kernel warning.

A low impact flaw was found in the Linux kernel mac80211 wireless subsystem. When a local user with the ability to request a wireless scan (for example via nl80211) triggers a scan on a device supporting 6 GHz High Efficiency (HE) bands, the kernel does not account for the HE 6 GHz Band Capability element when calculating the required scan element buffer length (scan_ies_len). Building the probe request elements can then fail and trigger the WARN_ON in __ieee80211_start_scan(), resulting in a local denial of service limited to the wireless scanning functionality. No memory corruption, information disclosure, or privilege escalation is involved; the size check safely aborts the operation. On systems configured with panic_on_warn, the kernel warning could additionally lead to a kernel panic.

The kernel and kernel-rt packages in Red Hat Enterprise Linux 8, 9, and 10, the Red Hat In-Vehicle OS 2 kernels, and the OpenShift Container Platform RHEL CoreOS kernels are affected. Red Hat Enterprise Linux 7 is not affected because the vulnerable code is not present, and Red Hat Enterprise Linux 6 is out of support scope. Given the low security impact, the fix for the affected products is deferred to a future scheduled update; the residual risk is limited to failed wireless scans and a kernel warning on hardware supporting the 6 GHz band. The CVSS:3.1 base score of 5.5 (Moderate) reflects the highest theoretical availability impact, while the practical impact is low because the flaw only causes the scan operation to fail and trigger a warning rather than corrupting memory or crashing the kernel under the default configuration.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.