CVE-2026-98421 in Linux
Summary
by MITRE • 10/14/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: require a peer station for TDLS setup confirm
It's nonsense for the setup confirm to go to station that doesn't even exist, and it hits a warning when building the frame:
WARN_ON_ONCE(!sta || !ap_sta)
Only accept WLAN_TDLS_SETUP_CONFIRM when the station is already there as a TDLS station. Need to copy the call to ieee80211_tdls_prep_mgmt_packet() since the existing WLAN_TDLS_DISCOVERY_REQUEST already falls through to it.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The Linux kernel vulnerability identified in the mac80211 wireless subsystem addresses a critical logic error within the implementation of Tunneled Direct Link Setup, commonly known as TDLS. This protocol allows two stations connected to an access point to establish a direct peer-to-peer link for data transfer without requiring traffic to be routed through the AP. The specific flaw resides in the handling of the WLAN_TDLS_SETUP_CONFIRM frame during the connection establishment phase. Under normal operational parameters, this confirmation message is intended to finalize the TDLS handshake between two valid peers that have already been authenticated and recognized by the network infrastructure. However, prior to the fix, the kernel did not sufficiently validate whether the target peer station actually existed in the local station table before attempting to process or respond to this setup confirm frame.
This lack of validation leads to a scenario where the system attempts to construct management frames for a non-existent station entity. The code path triggers an internal assertion failure represented by the warning condition WARN_ON_ONCE(ap_sta). This indicates that either the peer station structure pointer is null or the associated access point station information is missing, both of which are prerequisites for safely generating TDLS control packets. By allowing this frame to proceed without verifying the existence of the target STA, the kernel enters an undefined state where it attempts to manipulate memory structures that have not been properly initialized or allocated for that specific peer relationship. This can result in a denial of service condition characterized by kernel warnings and potential system instability if the null pointer dereference is triggered during frame preparation.
From a technical perspective, this vulnerability represents a classic case of insufficient input validation leading to improper resource management. The failure occurs because the code assumes the presence of specific data structures based on the receipt of a control frame rather than verifying their actual existence in the system state. This aligns with CWE-20 Improper Input Validation and CWE-476 NULL Pointer Dereference, as the application fails to check for null pointers before using them. The operational impact includes potential disruption of wireless connectivity for devices attempting to establish TDLS links, which are often used for high-throughput applications such as video streaming or large file transfers between nearby devices. An attacker could potentially exploit this by crafting malicious TDLS setup confirm frames directed at non-existent peers, thereby inducing the kernel warning and consuming system resources through repeated failed attempts.
The remediation involves enforcing strict state checks before processing WLAN_TDLS_SETUP_CONFIRM messages. The fix requires that the peer station must already be present in the network as a recognized TDLS station for the confirmation to be accepted. This ensures that all necessary data structures, including the station entry and its associated access point context, are valid and allocated prior to frame construction. Additionally, the solution involves copying the call to ieee80211_tdls_prep_mgmt_packet() from other parts of the codebase where it is already correctly implemented for similar frames like WLAN_TDLS_DISCOVERY_REQUEST. This standardization ensures consistent handling across different TDLS message types. From a defensive standpoint, this patch mitigates risks associated with CWE-754 Improper Check for Unusual or Exceptional Conditions and reduces the attack surface by ensuring that only valid peer relationships can proceed through the setup confirmation stage. Security practitioners should ensure their systems are updated to include this kernel fix to maintain the integrity of wireless management frame processing and prevent potential denial-of-service scenarios arising from malformed TDLS interactions.