CVE-2026-98183 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: avoid out-of-bounds read for empty PREQ elements
ieee80211_mesh_preq_size_ok() derives the location of the PREQ bottom fields before checking whether the element contains even the fixed header. ieee80211_mesh_hwmp_preq_get_bottom() reads the flags byte to account for the optional Address Extension field. Consequently, an empty PREQ element causes a one-byte read beyond its declared payload.
Move the helper call after both size checks, so the bottom fields are only accessed when they are present.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified in the Linux kernel within the mac80211 subsystem represents a classic out-of-bounds memory access issue arising from improper validation sequencing during the processing of Mesh Path Request elements. Specifically, the function ieee80211_mesh_preq_size_ok is responsible for validating the integrity and size constraints of incoming PREQ data structures used in Wireless Mesh Networking protocols based on IEEE 802.11s. The core technical flaw lies in the order of operations performed by this validation routine. Before confirming that the received element contains at least the mandatory fixed header fields, the code attempts to derive the location of bottom-level fields required for further processing. This premature derivation sets up a pointer or offset calculation that assumes the presence of data which may not exist if the PREQ element is empty or malformed.
This flawed logic directly impacts the subsequent function ieee80211_mesh_hwmp_preq_get_bottom, which is tasked with parsing specific flags to determine whether an optional Address Extension field is present in the message structure. Because the initial size check was bypassed or performed after this derivation step, the system proceeds to read a flags byte from memory locations that lie beyond the declared payload boundary of the PREQ element when the element is empty. This results in a one-byte out-of-bounds read operation. While the immediate impact might appear limited due to the single byte involved, such memory violations are significant security risks as they can lead to information disclosure by leaking kernel stack or heap data into user-space accessible structures, or potentially trigger undefined behavior that could be leveraged for further exploitation depending on the surrounding memory layout and compiler optimizations.
From a classification perspective, this vulnerability aligns with CWE-125, which defines out-of-bounds read vulnerabilities where software reads past the end of a buffer. In the context of attack vectors, this flaw can be exploited remotely by an attacker sending crafted wireless mesh frames to a vulnerable device, potentially falling under ATT&CK techniques related to reconnaissance or initial access if combined with other weaknesses, though primarily it serves as a stability and confidentiality risk within the network stack processing layer. The operational impact includes potential kernel panics or crashes due to accessing invalid memory pages, which degrades system availability for wireless mesh networks relying on this subsystem.
The resolution involves reordering the validation logic to ensure that all necessary size checks are completed before any attempt is made to access specific fields within the PREQ element payload. By moving the helper call responsible for deriving bottom field locations after both critical size validations, the code guarantees that memory accesses only occur when it has been mathematically confirmed that the required data exists within the buffer boundaries. This fix enforces a strict defense-in-depth approach where input validation precedes any parsing or interpretation of untrusted network data. To mitigate similar risks in broader contexts, developers should adhere to principles requiring exhaustive boundary checks before pointer arithmetic and utilize static analysis tools capable of detecting out-of-bounds access patterns during the software development lifecycle.