In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: minstrel_ht: validate fixed rate index The fixed_rate_idx… (CVE-2026-98703)

The Linux kernel's mac80211 minstrel_ht driver exposes a debugfs attribute fixed_rate_idx that accepts any 32-bit unsigned integer. The value is used to index arrays related to rate statistics without proper validation, allowing out-of-bounds array access and kernel memory corruption. Valid values are only those corresponding to valid group/rate pairs or U32_MAX to disable fixed rate processing. The vulnerability is reachable only through a root-only debugfs interface, so it does not constitute a privilege boundary violation but is a serious kernel memory corruption bug. The issue is identified as CVE-2026-98703.

The vulnerability can cause out-of-bounds memory writes in kernel space, leading to kernel memory corruption. While it does not allow privilege escalation due to root-only access to the debugfs file, it can destabilize the kernel or cause denial of service. There is no indication of known exploits in the wild.

A fix is available that validates the fixed_rate_idx value before use, rejecting any invalid values except valid group/rate pairs or U32_MAX. Since the vulnerable interface is only accessible to root via debugfs, restricting root access and unmounting debugfs can mitigate risk. Check the vendor advisory or Linux kernel patch notes for the official fix and apply updates accordingly.