CVE-2026-98334 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: reset state when starting AP fails
ieee80211_start_ap() can set enable_beacon (and beacon_int) and fail later, leaving it set forever. Scanning can then attempt to restore beaconing on such an interface, leading to:
Oops: divide error: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:mac80211_hwsim_link_info_changed+0xca7/0xf00 Call Trace: drv_link_info_changed+0x413/0x860 net/mac80211/driver-ops.c:495 ieee80211_link_info_change_notify+0x24b/0x3c0 net/mac80211/main.c:427 ieee80211_offchannel_return+0x381/0x580 net/mac80211/offchannel.c:160 __ieee80211_scan_completed+0x993/0xe30 net/mac80211/scan.c:519 ieee80211_scan_work+0x472/0x2010 net/mac80211/scan.c:1193 cfg80211_wiphy_work+0x2b7/0x550 net/wireless/core.c:538
in hwsim. Also, cfg80211 then allows changing the interface type, and the off-channel path getgs confused about beaconing as well, leading to another warning:
WARNING: net/mac80211/driver-ops.c:468 at drv_link_info_changed+0x583/0x880 ieee80211_link_info_change_notify+0x24b/0x3c0 net/mac80211/main.c:427 ieee80211_offchannel_stop_vifs+0x328/0x5c0 net/mac80211/offchannel.c:122 ieee80211_start_sw_scan net/mac80211/scan.c:583 [inline]
__ieee80211_start_scan+0xfb6/0x1af0 net/mac80211/scan.c:882
Reset the state on failures to always have it correct.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified in the Linux kernel's mac80211 subsystem represents a critical state management flaw within the wireless networking stack, specifically affecting the access point initialization process. The core issue resides in the ieee80211_start_ap function, which is responsible for configuring an interface to operate as an access point. During this operation, the system sets internal flags such as enable_beacon and beacon_int to indicate that beaconing should be active. However, if the subsequent steps of the initialization process fail due to hardware constraints, driver errors, or configuration conflicts, these state variables remain set despite the failure to actually establish the access point role. This creates a persistent inconsistency where the kernel's internal representation of the interface state diverges from its actual operational status, leading to undefined behavior when other subsystems interact with this corrupted state.
The immediate technical consequence of this state corruption manifests as severe runtime errors during subsequent network operations, particularly scanning and interface type changes. When the system attempts to perform a scan or return from an off-channel operation, it relies on the assumption that if enable_beacon is set, beaconing infrastructure is correctly initialized. Because the flag remains true after a failed AP start, the kernel proceeds with logic paths designed for active access points. This triggers a divide error in the mac80211_hwsim_link_info_changed function when running under KASAN (Kernel Address Sanitizer) conditions, resulting in an Oops and potential system instability or crash. The call trace indicates that this failure occurs during link info change notifications triggered by off-channel return processes, highlighting how scanning activities can inadvertently expose the corrupted state to critical driver operations.
Furthermore, the vulnerability extends beyond simple crashes to include logic errors in interface management. The cfg801 subsystem allows for changes to the interface type even when the underlying mac80211 state is inconsistent. This leads to confusion within the off-channel path regarding beaconing status, resulting in additional warnings and potential functional degradation. The drv_link_info_changed function emits a warning because it detects an attempt to modify link information under conditions that should not permit such changes given the actual driver capabilities or current state. These issues collectively demonstrate how improper error handling can propagate corruption through multiple layers of the networking stack, affecting both stability and functionality in complex wireless scenarios involving virtual interfaces and scanning operations.
From a security perspective, this vulnerability aligns with CWE-665 Improper Initialization, as the system fails to properly initialize or reset state variables upon failure conditions. It also relates to CWE-20 Improper Input Validation indirectly, since the lack of proper cleanup allows invalid internal states to persist and be acted upon by other components. In terms of MITRE ATT&CK mapping, this type of flaw could potentially be leveraged in a Denial of Service attack if an attacker can trigger repeated AP start failures followed by scanning or interface changes, causing system crashes or resource exhaustion. While not directly exploitable for code execution without additional context, the instability introduced poses significant risks to service availability and reliability in environments relying on Linux-based wireless infrastructure.
To mitigate this vulnerability, it is essential that developers ensure all state variables are reset to their default values whenever a critical operation like ieee80211_start_ap fails. The fix involves adding cleanup logic at every exit point of the function where failure occurs, ensuring that enable_beacon and beacon_int are cleared if the access point setup does not complete successfully. This guarantees that subsequent operations such as scanning or interface type changes operate on accurate state information. System administrators should apply kernel updates containing this patch to prevent potential crashes in wireless-enabled systems. Additionally, rigorous testing of error paths during device initialization is recommended to catch similar state management issues before they reach production environments, ensuring robust handling of hardware and driver failures within the mac80211 framework.