VulnerabilityPublished 18 Oct 2026

CVE-2026-98702: Linux kernel · wifi: mac80211: reject invalid 320 MHz CSA bandwidth

Source GCVE Database

Authoritative record:CVE-2026-98702· Medium

Not known to be exploited · fixed in cf0ddacce173890407ed3fa50c8ea9b3c0cc0e16 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 14:05 UTC

Severity

Medium

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 5% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in cf0ddacce173890407ed3fa50c8ea9b3c0cc0e16, 1892e71aa2e5ee667d87c6e49e3661f5e290303b, 79b3ce0d881cd6e5d4d3496b19f5cc5e7089a56c +1

Exploitation evidence

Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-6466-2f74-2mgw

What to do

Upgrade Linux kernel to cf0ddacce173890407ed3fa50c8ea9b3c0cc0e16, 1892e71aa2e5ee667d87c6e49e3661f5e290303b, 79b3ce0d881cd6e5d4d3496b19f5cc5e7089a56c or 56e236759f0a8dc910c2ae7cd3c161f298ee5794.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 21c3f8f95554feff9bed15703e89adbe582e0383, < cf0ddacce173890407ed3fa50c8ea9b3c0cc0e16	Fixed in cf0ddacce173890407ed3fa50c8ea9b3c0cc0e16
LinuxLinux	Affected ≥ 21c3f8f95554feff9bed15703e89adbe582e0383, < 1892e71aa2e5ee667d87c6e49e3661f5e290303b	Fixed in 1892e71aa2e5ee667d87c6e49e3661f5e290303b
LinuxLinux	Affected ≥ 21c3f8f95554feff9bed15703e89adbe582e0383, < 79b3ce0d881cd6e5d4d3496b19f5cc5e7089a56c	Fixed in 79b3ce0d881cd6e5d4d3496b19f5cc5e7089a56c
LinuxLinux	Affected ≥ 21c3f8f95554feff9bed15703e89adbe582e0383, < 56e236759f0a8dc910c2ae7cd3c161f298ee5794	Fixed in 56e236759f0a8dc910c2ae7cd3c161f298ee5794
LinuxLinux	Affected =6.9	Fixed in–

AI-suggested

A fix is available that rejects invalid 320 MHz CSA bandwidth channel definitions before processing, preventing the uninitialized read and kernel panic. Users should apply the official Linux kernel updates that include this patch. No additional mitigations are indicated.

Description

A vulnerability in the Linux kernel's mac80211 WiFi subsystem allowed invalid 320 MHz channel switch announcements (CSA) bandwidths to be processed on non-6 GHz links. This caused an uninitialized read of the channel width field, which could trigger a kernel panic if panic_on_warn was enabled. The issue has been resolved by rejecting invalid channel definitions before processing them, preventing the uninitialized read and kernel panic.

Impact

This vulnerability can cause a denial of service via a kernel panic triggered by a specially crafted CSA frame with an invalid 320 MHz bandwidth indication on non-6 GHz WiFi links. Systems with panic_on_warn enabled are susceptible to this crash, potentially disrupting network connectivity or system availability.

Summary

The Linux kernel's mac80211 component did not properly validate HT/VHT channel definitions when receiving CSA frames indicating a 320 MHz bandwidth on non-6 GHz links. Although a warning was issued for this unsupported bandwidth, the code continued and read an uninitialized vht_operation.chan_width field. This uninitialized read could cause a kernel panic if the kernel was configured with panic_on_warn. The fix involves rejecting invalid channel definitions early to avoid the uninitialized read and associated kernel panic, while preserving existing fallback behavior.

References

Community reviews

Loading reviews…