CVE-2026-98421

A flaw was found in the Linux kernel's mac80211 wireless subsystem. A local attacker can cause a denial of service (DoS) by requesting a Tunneled Direct Link Setup (TDLS) setup confirmation for a nonexistent peer station. Because the subsystem does not verify that the peer station exists before preparing the management frame, this issue triggers an internal kernel warning that may result in system instability or a crash.

A low impact denial of service flaw was found in the Linux kernel's mac80211 wireless subsystem, affecting the kernel as shipped in Red Hat Enterprise Linux 8, 9, and 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform 4 and 5 releases (via their RHEL CoreOS-based kernels). When handling a Tunneled Direct Link Setup (TDLS) setup confirmation for a peer station that does not exist, mac80211 prepares the management frame without first verifying that the TDLS peer station is present, which triggers the WARN_ON_ONCE(!sta || !ap_sta) assertion in net/mac80211/tdls.c. A local user able to issue TDLS management commands (for example through nl80211) can exploit this to cause a kernel warning; on systems where the panic_on_warn kernel option is enabled, the warning results in a kernel panic, causing a local denial of service. Confidentiality and integrity are not affected. Red Hat Enterprise Linux 7 is not affected because the vulnerable code is not present in its kernel, and Red Hat Enterprise Linux 6 Extended Lifecycle Support is out of support scope. While the CVSS:3.1 base score for this flaw is 5.5 (Moderate), Red Hat rates its impact as Low because the effect is limited to a kernel warning, and a system crash occurs only when panic_on_warn is enabled. Given the low impact and the local access required, the fix is deferred and will be addressed in a future scheduled kernel update; the residual risk until then is a local denial of service by an attacker who already has local access to the system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.