In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: handle empty FILS association request payload… (CVE-2026-98698)

The Linux kernel mac80211 wifi subsystem had a vulnerability where fils_encrypt_assoc_req() accepted a (Re)Association Request frame ending with an empty FILS Session element, resulting in a zero-length plaintext for AES-SIV encryption. Since kmemdup() returns ZERO_SIZE_PTR for zero-length allocations, sg_init_one() was called with an invalid page, causing a kernel BUG under CONFIG_DEBUG_SG or passing an invalid page to the crypto backend otherwise. AES-SIV encryption is defined for empty plaintext, producing the S2V result as output, so the vulnerability was fixed by handling this case correctly before the CTR encryption step.

This vulnerability could cause a kernel BUG or improper handling of crypto operations in the wifi mac80211 subsystem when processing empty FILS association request payloads. This may lead to system instability or crashes. There is no indication of remote code execution or privilege escalation from the provided data.

A fix has been implemented in the Linux kernel to properly handle empty FILS association request payloads in the mac80211 wifi component. Users should update to the fixed kernel version once available. No additional mitigation steps are specified.