CVE-2026-98337

A flaw was found in the Linux kernel's mac80211 wireless subsystem. A local user can cause a Denial of Service (DoS) or system instability by initiating a remain-on-channel (ROC) operation while a wireless network scan is concurrently active. This race condition leads to improper state handling and triggers kernel warnings, potentially disrupting system operations.

A flaw was found in the Linux kernel's mac80211 wireless subsystem that Red Hat rates as Low impact. A race condition allows a local user with privileges to issue wireless configuration commands (scanning and remain-on-channel requests via nl80211 require CAP_NET_ADMIN) to add a new remain-on-channel (ROC) request to the ROC list while a wireless scan is concurrently in progress, even though a scan requires that list to be empty. The resulting improper state handling triggers a kernel WARNING in ieee80211_start_next_roc (net/mac80211/offchannel.c), which can disrupt wireless operation and, on systems configured with panic_on_warn, can crash the kernel and cause a local denial of service. No confidentiality or integrity impact is supported by the affected code path, and triggering the race requires precise timing in addition to local privileged access.

The kernel in Red Hat Enterprise Linux 8, 9, and 10, the kernel and kernel-ivos-qualcomm packages in Red Hat In-Vehicle OS 2, and the RHEL CoreOS kernels used by OpenShift Container Platform 4 and 5 are affected, with the fix deferred to a future planned update because the issue is a timing-dependent race of low severity whose exploitation requires a local privileged user and whose impact is limited to availability. The residual risk until the fix is delivered is a kernel warning or, on panic_on_warn systems, a locally triggered system crash. The Red Hat Enterprise Linux 7 kernel and kernel-rt are not affected because the vulnerable code is not present in those releases, and Red Hat Enterprise Linux 6 Extended Lifecycle Support is out of support and not scheduled to receive a fix.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.