CVE-2026-98340 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: only group hidden BSSes with beacon entries
When a probe response for an unknown BSS comes in, __cfg80211_bss_update() looks for an existing entry with the same BSSID and a hidden (zero-length or NUL-filled) SSID, and if it finds one it groups them, using the beacon IEs from the existing entry.
But that could find another entry without a beacon, if it was also from a probe response (with SSID), so there's a group without beacon elements.
If a beacon with a hidden SSID for that BSSID arrives later, cfg80211_combine_bsses() goes looking for the probe response entries that belong to it - i.e. entries with the same BSSID and channel that have no beacon IEs - and finds those two. They are already grouped with each other, so it hits its
WARN_ON_ONCE(bss->pub.hidden_beacon_bss) WARN_ON_ONCE(!list_empty(&bss->hidden_list))
which are there because an entry without beacon elements is not supposed to be part of a group yet.
Only combine entries when a beacon was already received, ones that are kept separate will be combined when a beacon arrives.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability in the Linux kernel's wireless configuration subsystem involves a logic error within the BSS (Basic Service Set) management code specifically affecting how hidden SSIDs and probe responses are grouped together. The core issue resides in the __cfg80211_bss_update function, which is responsible for updating or creating entries for detected networks. When a probe response arrives from an unknown BSSID that has a hidden or zero-length SSID, the system attempts to group it with any existing entry sharing the same BSSID but also possessing a hidden SSID characteristic. The intended design assumes that such grouping relies on beacon Information Elements (IEs) present in the existing entry to provide necessary network context and configuration data for clients attempting to connect.
However, the implementation flaw allows this grouping logic to incorrectly match with an existing entry that was itself created from a probe response rather than a beacon frame. Probe responses do not contain all the mandatory beacon IEs required for stable BSS representation. Consequently, two entries lacking proper beacon elements are grouped together prematurely. This creates a composite BSS object that lacks the critical beacon Information Elements needed for correct operation by wireless clients and management tools. The system incorrectly treats this probe-response-derived group as if it were anchored by valid beacon data, leading to state inconsistencies within the kernel's networking stack.
The operational impact becomes evident when a legitimate beacon frame with a hidden SSID subsequently arrives for that same BSSID. The cfg80211_combine_bsses function attempts to merge this new beacon entry with existing probe response entries associated with the same channel and BSSID. It searches for entries without beacon IEs, expecting them to be separate entities ready for combination. Instead, it encounters the previously mis-grouped pair of probe-response-only entries. Because these are already linked in a hidden list structure that violates internal consistency checks, the kernel triggers WARN_ON_ONCE assertions. These warnings indicate that an entry lacking beacon elements is improperly part of a group intended only for beacon-anchored BSS objects. This can lead to kernel warning floods, potential instability, or incorrect network association behavior depending on how subsequent code handles these assertion failures and corrupted state structures.
From a security perspective, this vulnerability aligns with CWE-841 Improper Enforcement of Behavioral Workflow, as the system fails to enforce the correct sequence of operations where beacon data must precede certain grouping actions. It also relates to CWE-20 Improper Input Validation because the code does not adequately validate that the target entry for grouping actually contains the required beacon Information Elements before proceeding with the association logic. In terms of MITRE ATT&CK, this type of state confusion and assertion failure can be leveraged in denial-of-service scenarios if an attacker can trigger repeated probe responses from hidden networks to cause kernel warnings or instability on affected systems.
Mitigation strategies primarily involve applying vendor-provided patches that update the Linux kernel's wireless subsystem logic. The fix ensures that grouping only occurs when a beacon entry is already present, preventing the premature combination of two probe-response-only entries. System administrators should ensure their kernels are updated to versions containing this specific cfg80211 correction. Additionally, monitoring system logs for repeated WARN_ON_ONCE messages related to wifi or cfg80211 can help identify systems still running vulnerable code in production environments where hidden SSID networks are actively scanned or connected to.