CVE-2026-98338

A flaw was found in the Linux kernel's cfg80211 wireless subsystem. A race condition occurs during Independent Basic Service Set (IBSS, an ad-hoc wireless network) join event handling because the kernel does not hold an active reference to the service set entry before processing the event. A local user could trigger this issue by initiating a concurrent wireless scan that flushes the entry while the event is queued, potentially resulting in a system crash and Denial of Service (DoS).

A low impact race condition was found in the Linux kernel's cfg80211 wireless subsystem, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 7, 8, 9, and 10, the Red Hat In-Vehicle OS kernels, and the RHEL CoreOS 8 and RHEL CoreOS 9 kernels shipped with OpenShift Container Platform. When an IBSS (ad-hoc wireless network) is joined, the kernel records only the BSSID/channel in the event and looks up the BSS entry later, when the event is processed on the cfg80211 event workqueue. A local user with privileges to manage wireless configuration could initiate a concurrent scan with NL80211_SCAN_FLAG_FLUSH that removes the BSS entry while the join event is still queued, triggering a kernel WARNING in __cfg80211_ibss_joined and disrupting IBSS join handling. A system crash and denial of service is possible only on systems configured to panic on warnings; no use-after-free or other memory corruption is established in the affected path. The impact was rated Low because exploitation requires local access with administrative network privileges and winning a timing-dependent race, and the realistic consequence is a kernel warning and disruption of IBSS state or connectivity; the CVSS:3.1 score of 5.5 (Moderate) reflects only the upper-bound availability impact. Because of the low impact, fixes for the affected products are deferred to a future scheduled update, and the residual risk is limited to local denial of service on systems that use IBSS ad-hoc wireless networking.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.