CVE-2026-98702 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: reject invalid 320 MHz CSA bandwidth
The HT/VHT channel definition validator can receive a 320 MHz bandwidth indication from a received CSA frame on a non-6 GHz link. It warns for this unsupported width but continues with an uninitialized vht_operation.chan_width, which is then read by ieee80211_chandef_vht_oper(). With panic_on_warn enabled, this lets a received frame panic the kernel.
Reject the channel definition before entering the VHT operation conversion. This preserves the existing CSA fallback while avoiding both the warning and the uninitialized read.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/18/2026
The vulnerability identified in the Linux kernel's mac80211 subsystem involves an improper validation of Channel Switch Announcement frames, specifically regarding bandwidth indications for non-6 GHz links. The High Throughput and Very High Throughput channel definition validator is designed to process incoming wireless management frames that instruct clients to switch channels. However, when a received CSA frame contains a 320 MHz bandwidth indication on a link operating outside the 6 GHz spectrum, the validation logic fails to halt processing immediately. Instead of rejecting this unsupported configuration at the earliest possible stage, the validator issues a warning but allows execution to proceed into subsequent conversion routines that assume valid input parameters.
This procedural flaw leads directly to an uninitialized variable read within the VHT operation structure. Specifically, after the flawed validation step, the code proceeds to convert channel definitions using ieee80211_chandef_vht_oper(). Because the bandwidth indication was invalid and not properly rejected earlier in the pipeline, the vht_operation.chan_width field remains uninitialized. When this routine attempts to read from this memory location, it accesses undefined data. In environments where kernel panic-on-warn is enabled, which is a common configuration for security-hardened or development systems to catch logic errors early, this access triggers an immediate kernel panic. This effectively allows a remote attacker who can transmit malicious 802.11 frames to cause a denial of service by crashing the wireless subsystem and potentially the entire host system.
From a classification perspective, this issue aligns with CWE-457, which describes the use of an uninitialized variable, as well as CWE-20, indicating improper input validation where external data is not adequately checked for validity before processing. The attack vector corresponds to MITRE ATT&CK technique T1498, Network Denial of Service, specifically through resource exhaustion or system instability caused by malformed network packets. The vulnerability highlights a critical gap in the boundary checking logic between frame reception and internal state initialization within the wireless stack.
To mitigate this risk, the fix involves rejecting invalid channel definitions before they enter the VHT operation conversion phase. By validating the bandwidth constraints strictly at the point of CSA frame parsing, the system prevents the propagation of erroneous data into deeper kernel structures. This approach preserves the existing fallback mechanisms for Channel Switch Announcements while eliminating both the warning condition and the subsequent uninitialized memory read. System administrators should ensure that their Linux kernels are updated to include this patch, particularly if they operate in environments where panic-on-warn is enabled or where wireless infrastructure must remain highly available against potential RF-based denial of service attacks.