In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate TX status rate metadata minstrel_ht_tx_status()… (CVE-2026-98824)

The Linux kernel's mac80211 component had a vulnerability where minstrel_ht_tx_status() converted HT/VHT TX status rate metadata into indices for rate tables without fully validating that the reported MCS, spatial stream count, and bandwidth were representable by those tables. This allowed malformed metadata to cause out-of-bounds indexing. The fix moves validation of rate metadata to the common TX status path, sanitizing entries before any consumers use them. This prevents a single bad report from corrupting mac80211 state and maintains driver responsibility for sane values. No kernel warnings or panics are triggered by this validation.

Malformed TX status rate metadata could cause out-of-bounds indexing in the minstrel_ht rate tables, potentially corrupting mac80211 wireless subsystem state. This could lead to instability or unexpected behavior in wireless rate control. However, the fix prevents such corruption by sanitizing inputs early, reducing risk of denial of service or state corruption from malformed driver reports.

A fix has been implemented in the Linux kernel to validate TX status rate metadata early in the processing path, preventing out-of-bounds indexing. Users should update to a Linux kernel version that includes this fix. Since this is a kernel-level fix, no additional mitigation steps are required beyond applying the official patch when available.