CVE-2026-98406

A flaw was found in the Linux kernel's mac80211 wireless subsystem. A local attacker can trigger a denial of service (DoS) condition by issuing a wireless bitrate configuration request while a network interface is undergoing initialization or teardown. Because the subsystem fails to verify that the interface is actively attached to the underlying driver, processing the request triggers an internal kernel warning that can lead to system instability.

A flaw of low impact was found in the Linux kernel's mac80211 wireless subsystem, which affects the kernels shipped in Red Hat Enterprise Linux, Red Hat In-Vehicle OS, and OpenShift Container Platform (via RHEL CoreOS). A local attacker with the ability to issue wireless extension ioctls can trigger a denial of service by sending an SIOCSIWRATE bitrate-configuration request while a wireless interface is running but not yet (or no longer) registered with its driver, for example during interface bringup or teardown. Because ieee80211_set_bitrate_mask() does not verify that the interface is present in the driver, the request reaches drv_set_bitrate_mask() and triggers a WARN_ONCE assertion, which can cause system instability or a kernel panic on systems configured to panic on warnings. Confidentiality and integrity are not affected. Red Hat rates the impact of this flaw as low because the direct effect is a kernel warning and a crash requires the non-default panic_on_warn configuration, which is lower than the severity implied by the maximum-availability CVSS:3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 5.5 Moderate). Fixes for the affected Red Hat products are currently deferred to future updates; the residual risk is limited to local denial of service by an attacker who already has local access and the privileges needed to issue wireless configuration ioctls.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.