CVE-2026-98345

A flaw was found in the Linux kernel's cfg80211 wireless subsystem. A local attacker can cause a Denial of Service (DoS) by transmitting crafted network frames that appear to be Internet Protocol (IP) traffic. Because the kernel fails to verify that the frame is large enough to hold a complete header before reading traffic priority fields, it reads uninitialized memory, potentially crashing the system.

A low-impact flaw was found in the Linux kernel's cfg80211 wireless subsystem in the cfg80211_classify8021d() function. When a locally transmitted frame claims to be IPv4 or IPv6 traffic but is shorter than the corresponding IP header, the function reads the DSCP field from uninitialized memory while classifying the frame for 802.1d queue selection, as reported by KMSAN. A local attacker who can transmit crafted frames, which requires local privileges such as CAP_NET_RAW or an equivalent capability needed to send raw packets, could use this flaw to cause a denial of service by crashing the kernel. The uninitialized value is only consumed internally for queue selection, so it is not disclosed to user space and cannot be used for privilege escalation or data modification. Although the Red Hat CVSS 3.1 score of 5.5 (Moderate, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects high availability impact, Red Hat rates the overall security impact of this flaw as Low, because the uninitialized value only influences internal traffic classification and a kernel panic is not the expected outcome on standard configurations. The Red Hat Enterprise Linux 6 ELS stream is recorded as out of support scope for this flaw. For the affected Red Hat Enterprise Linux, Red Hat In-Vehicle OS, and OpenShift Container Platform (RHEL CoreOS) streams, the fix is deferred: due to the Low security impact, it will be addressed in a future planned kernel update rather than through an immediate update. The residual risk is limited to a local denial of service by an attacker who already holds the local privileges required to transmit raw frames.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.