CVE-2026-98339 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: don't filter by BSS type when removing stale entries
When an assoc AP switches to a channel that already has a BSS entry, cfg80211_update_assoc_bss_entry() removes that entry before rehashing the real one, since the two would otherwise collide in the BSS rbtree.
The lookup for that entry also required it to match the connection's BSS type, so an entry advertising e.g. the IBSS capability bit was left in place, and the following cfg80211_rehash_bss() then ran into it:
WARN_ON(!cmp)
Changing the type shouldn't really happen, but can be triggered by a rogue AP/device, so drop the check and remove any entries matching the comparison.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability described involves a logic error in the Linux kernel's wireless configuration subsystem, specifically within the cfg80211 module responsible for managing 802.11 network interfaces and station associations. The core issue arises during the process of updating or rehashing Basic Service Set entries when an access point changes its operating channel. Under normal operational conditions, if a new association occurs on a channel that already contains an existing BSS entry in the kernel's internal red-black tree data structure, the system must remove the stale entry to prevent collisions before inserting the updated information. This mechanism ensures that the network stack maintains accurate and non-conflicting records of available wireless networks for connection management and roaming decisions.
The technical flaw lies in the criteria used to identify which existing entries should be removed during this cleanup process. The original implementation required a strict match on the BSS type, such as distinguishing between infrastructure mode, ad-hoc mode (IBSS), or other specific 802.11 operational modes. This rigid filtering logic failed to account for scenarios where an access point might advertise capabilities that differ from its current operational state or when malicious actors manipulate these advertisements. Specifically, if a rogue device advertises the IBSS capability bit while operating as a standard infrastructure AP, the lookup function would fail to identify it as a duplicate entry because the BSS types did not match exactly. Consequently, the stale entry remained in memory even though its fundamental identifiers like MAC address and channel matched those of the new association attempt.
This oversight leads directly to a kernel warning condition triggered by cfg80211_rehash_bss(). When the system attempts to reinsert or update the BSS information into the rbtree, it encounters the previously unremoved stale entry that shares conflicting attributes with the incoming data structure. The code contains an assertion check using WARN_ON(!cmp) which detects this collision and triggers a kernel warning. While this specific instance may not result in immediate system crash or privilege escalation due to the defensive nature of the warning, it indicates a state inconsistency within the wireless stack. Such inconsistencies can degrade network performance, cause connection failures for legitimate users attempting to roam between access points, and potentially lead to denial-of-service conditions if repeated frequently enough to exhaust resources or destabilize the networking subsystem.
From a threat modeling perspective, this vulnerability is exploitable by an attacker operating a rogue wireless device within range of the target system. By manipulating beacon frames or probe responses to advertise conflicting BSS types while maintaining identical MAC addresses and channel settings as a legitimate network, an adversary can trigger this logic error repeatedly. This aligns with CWE-841 Improper Enforcement of Behavioral Workflow, as the software fails to correctly enforce the expected state transitions for wireless network entries. Furthermore, in the context of the MITRE ATT&CK framework, this behavior relates to techniques involving resource exhaustion or disruption of availability through manipulation of system resources, falling under tactics such as Impact or Defense Evasion depending on whether the goal is simply to disrupt service or hide malicious activity by causing instability in security monitoring components that rely on stable network state information.
The resolution involves modifying the lookup logic within cfg80211_update_assoc_bss_entry() to remove the strict BSS type matching requirement during the stale entry removal phase. Instead of requiring an exact match on operational mode, the function now removes any entries that match the primary comparison criteria, which typically include the MAC address and channel information. This ensures that all conflicting entries are cleared from the rbtree before rehashing occurs, preventing collisions regardless of how the BSS type is advertised by neighboring devices. This change enhances the robustness of the wireless stack against malformed or maliciously crafted 802.11 management frames without compromising legitimate network operations.
To mitigate this vulnerability and similar issues in wireless subsystems, system administrators should ensure that their Linux kernels are updated to include patches addressing cfg80211 logic errors. Since this is a kernel-level flaw affecting the core networking stack, it requires a full operating system update rather than application-level configuration changes. Additionally, deploying wireless intrusion detection systems can help identify rogue access points attempting to exploit such state confusion by broadcasting inconsistent or conflicting BSS parameters. Regular auditing of network configurations and monitoring for unusual warnings in kernel logs related to cfg80211 can also aid in early detection of exploitation attempts targeting this class of vulnerabilities.