CVE-2026-98703 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: minstrel_ht: validate fixed rate index
The fixed_rate_idx debugfs file is a plain u32 attribute, so any value can be written to it. minstrel_ht_update_stats() then copies the value into mi->max_tp_rate[] and mi->max_prob_rate, and
minstrel_ht_set_rate() uses MI_RATE_GROUP()/MI_RATE_IDX() to index minstrel_mcs_groups[] (42 entries) and mi->groups[].rates[] (10 entries)
with it.
Writing e.g. 65535 selects group 4095 and rate index 15, far outside both arrays. The out-of-bounds entries are dereferenced and updated as struct minstrel_rate_stats (retry counts, etc.), so the invalid index corrupts adjacent kernel memory. With CONFIG_UBSAN_BOUNDS the access is reported as an array-index-out-of-bounds in minstrel_ht_set_rate().
Only a valid group/rate pair, or U32_MAX to disable fixed rate processing, can be used safely, so reject any other value when the debugfs file is written.
The file is only reachable through a root-only debugfs mount, so this is not a privilege boundary. The out-of-bounds access is still a bug that must not be reachable through a writable debugfs attribute.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/18/2026
The Linux kernel vulnerability identified in the mac80211 subsystem within the minstrel_ht rate control algorithm represents an array index out of bounds error resulting from insufficient input validation on a debugfs interface. The specific flaw resides in the handling of the fixed_rate_idx file, which is exposed as a plain unsigned 32-bit integer attribute. Because this attribute lacks strict boundary checks during write operations, it allows any arbitrary u32 value to be written by processes with appropriate permissions. When such a value is processed, the minstrel_ht_update_stats function copies it into internal data structures including mi->max_tp_rate and mi->max_prob_rate. Subsequently, the minstrel_ht_set_rate function utilizes macros MI_RATE_GROUP and MI_RATE_IDX to decompose this input index for array access purposes. These indices are used to reference entries within the minstrel_mcs_groups array, which contains forty-two elements, and the mi->groups[].rates[] array, which holds ten elements.
The operational impact of this flaw is significant due to the potential for kernel memory corruption. When an invalid value such as sixty-five thousand five hundred thirty-five is written, it translates to a group index of four thousand ninety-five and a rate index of fifteen. Both values far exceed the bounds of their respective arrays. The subsequent dereferencing of these out-of-bounds indices leads to writes against struct minstrel_rate_stats objects located in adjacent kernel memory regions. This corruption affects critical statistics such as retry counts, potentially destabilizing the wireless driver's state machine and leading to unpredictable system behavior or crashes. Under configurations enabling UBSAN bounds checking, this issue manifests explicitly as an array-index-out-of-bounds error within the minstrel_ht_set_rate function, confirming the nature of the memory safety violation.
From a security classification perspective, this vulnerability aligns with CWE-125, which denotes Out-of-Bounds Read, and more critically CWE-787, Out-of-Bounds Write, given that the code updates statistical structures in adjacent memory locations. In terms of adversary behavior mapping to MITRE ATT&CK, this flaw relates to techniques involving exploitation for denial of service or potential privilege escalation if combined with other vulnerabilities, although its direct impact is primarily system stability and integrity compromise through kernel memory corruption. The vulnerability falls under the category of improper input validation where trusted inputs are not sufficiently sanitized before being used as array indices.
Mitigation strategies focus on enforcing strict range checks at the point of entry for the debugfs attribute. Developers must ensure that only valid group and rate pairs, or the specific sentinel value U32_MAX intended to disable fixed rate processing, are accepted by the write handler. Any other input should be rejected immediately with an appropriate error code. Although this vulnerability is accessible only through a root-only mounted debugfs interface and does not cross a privilege boundary in standard configurations, it remains a critical bug that violates kernel memory safety principles. The fix ensures that even privileged users cannot inadvertently trigger out-of-bounds accesses via the wireless rate control subsystem, thereby maintaining the integrity of adjacent kernel data structures and preventing potential denial of service conditions caused by memory corruption.