CVE-2026-98425

A flaw was found in the Linux kernel's mac80211 wireless subsystem. An unnecessary warning is triggered during an ad-hoc wireless network (Independent Basic Service Set or IBSS) scan when a regulatory domain change leaves no permitted channels available. A local user initiating network scans during this transition can cause the kernel to generate this warning, potentially leading to a Denial of Service (DoS) on systems configured to panic on warnings.

A low impact flaw was found in the Linux kernel's mac80211 wireless subsystem. When the regulatory domain changes while an ad-hoc (IBSS) network is operating, the ieee80211_request_ibss_scan() function can trigger a WARN_ON_ONCE() warning when no permitted channels remain available, because an IBSS interface may continue to operate briefly during the 60-second grace period before it is shut down. A local user with the privileges needed to configure wireless interfaces (CAP_NET_ADMIN) who triggers an IBSS scan during this window can cause this warning. In default kernel configurations the impact is limited to a warning message in the kernel log and the scan request failing with -EINVAL; there is no impact on confidentiality, integrity, or memory safety. Only systems configured with the non-default panic_on_warn option could experience a kernel panic (local denial of service) as a result of this warning, which is why Red Hat assesses the impact of this flaw as Low even though the worst-case CVSS 3.1 availability metric reflects the panic_on_warn scenario. The affected Red Hat Enterprise Linux kernel and kernel-rt streams, Red Hat In-Vehicle OS, and OpenShift RHCOS components are affected, and the fix, which simply removes the unnecessary warning, is deferred to a future update given the low security risk; the residual risk is limited to non-default panic_on_warn configurations where a privileged local user could trigger a panic. The Red Hat Enterprise Linux 6 Extended Lifecycle Support stream is out of support scope for this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

The only security consequence of this flaw occurs on systems running with the non-default kernel option panic_on_warn enabled, where the warning causes a kernel panic. On such systems the impact can be mitigated by disabling panic-on-warn, for example by running 'sysctl kernel.panic_on_warn=0' and persisting 'kernel.panic_on_warn = 0' in a file under /etc/sysctl.d/. On systems using default kernel settings, the flaw results only in a warning message in the kernel log and no specific mitigation is required.