164 lines
8.2 KiB
JSON
164 lines
8.2 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-98334",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-09-25T10:25:14.341Z",
|
|
"datePublished": "2026-10-06T08:46:25.992Z",
|
|
"dateUpdated": "2026-10-19T09:17:45.494Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-10-19T09:17:45.494Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: reset state when starting AP fails\n\nieee80211_start_ap() can set enable_beacon (and beacon_int) and fail\nlater, leaving it set forever. Scanning can then attempt to restore\nbeaconing on such an interface, leading to:\n\n Oops: divide error: 0000 [#1] SMP KASAN NOPTI\n RIP: 0010:mac80211_hwsim_link_info_changed+0xca7/0xf00\n Call Trace:\n drv_link_info_changed+0x413/0x860 net/mac80211/driver-ops.c:495\n ieee80211_link_info_change_notify+0x24b/0x3c0 net/mac80211/main.c:427\n ieee80211_offchannel_return+0x381/0x580 net/mac80211/offchannel.c:160\n __ieee80211_scan_completed+0x993/0xe30 net/mac80211/scan.c:519\n ieee80211_scan_work+0x472/0x2010 net/mac80211/scan.c:1193\n cfg80211_wiphy_work+0x2b7/0x550 net/wireless/core.c:538\n\nin hwsim. Also, cfg80211 then allows changing the interface type,\nand the off-channel path getgs confused about beaconing as well,\nleading to another warning:\n\n WARNING: net/mac80211/driver-ops.c:468 at drv_link_info_changed+0x583/0x880\n ieee80211_link_info_change_notify+0x24b/0x3c0 net/mac80211/main.c:427\n ieee80211_offchannel_stop_vifs+0x328/0x5c0 net/mac80211/offchannel.c:122\n ieee80211_start_sw_scan net/mac80211/scan.c:583 [inline]\n __ieee80211_start_scan+0xfb6/0x1af0 net/mac80211/scan.c:882\n\nReset the state on failures to always have it correct."
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"net/mac80211/cfg.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "d6a83228823fc0cc8d79d95c9f0bf568b7317862",
|
|
"lessThan": "d83da43e9b3b3b1bad99ac5a1065f1c63ad5fc32",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "d6a83228823fc0cc8d79d95c9f0bf568b7317862",
|
|
"lessThan": "5d5ff5b36f5748a2a077f875a73ccb26860d3fcc",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "d6a83228823fc0cc8d79d95c9f0bf568b7317862",
|
|
"lessThan": "6eac225f59c1c2277ac74f8a716d6df0ba3b8d28",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "d6a83228823fc0cc8d79d95c9f0bf568b7317862",
|
|
"lessThan": "3f28551d0241254a75626d868041c6340285088b",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"net/mac80211/cfg.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "3.9",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "3.9",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.112",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.54",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.2.8",
|
|
"lessThanOrEqual": "7.2.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.3",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "3.9",
|
|
"versionEndExcluding": "6.12.112"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "3.9",
|
|
"versionEndExcluding": "6.18.54"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "3.9",
|
|
"versionEndExcluding": "7.2.8"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "3.9",
|
|
"versionEndExcluding": "7.3"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/d83da43e9b3b3b1bad99ac5a1065f1c63ad5fc32"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/5d5ff5b36f5748a2a077f875a73ccb26860d3fcc"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/6eac225f59c1c2277ac74f8a716d6df0ba3b8d28"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/3f28551d0241254a75626d868041c6340285088b"
|
|
}
|
|
],
|
|
"title": "wifi: mac80211: reset state when starting AP fails",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |