From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AA7DB3E1CE5 for ; Tue, 6 Oct 2026 10:28:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791282511; cv=none; b=m7CIgBwtmDqJNC8rVVcoz6nwhYHJ/o3veXqu85qzt1Tw02bR85oUM0InXXkx1j7ggTMtOD/KqxNmbRvSFl2JC047GY6LhLXFe092CQZUzWf0cMaW4p1nFHM0Vb9wQ7hoYHy9P45oC1dj1rLywOJb9OWfuFJ2rItv8pd8M4OLdBk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791282511; c=relaxed/simple; bh=bstMwsQ7YqEqlOWpwymjS1nLgtae/PI84pD35+jDT+A=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=XFVyi7IKRwAa4zodulTKj+dS8OvWl1dAbHKvV1UCPDL1k8pirjIqnHCk5PU+gbgYH7TsR6VLjnmKT+sekUpp4jMAR8UvMMgg/mYdkKjWk9eDHvJR4aZSN1B0ORWiRC59Lfkfu64bh4JNnbjDApd7yKDA0jgG+cH3lSEFLml8fUM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=axO0Jp2k; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="axO0Jp2k" Received: by smtp.kernel.org (Postfix) with ESMTPSA id EC8E51F000FF; Tue, 6 Oct 2026 10:28:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1791282510; bh=Xxo/FQOuSszMgC02PUe9Fs+b17Zqtg1PaOnCg97geIs=; h=From:To:Cc:Subject:Date:Reply-To; b=axO0Jp2kmy2gkhnMgl8Dm/M1rBuABcfNscEc7bPtpG0R+1GYXf8pTgv15R2TQTXWi uUrZqOM72AzrgTBWoH7YV4VJRSFfBL1D2moVTk/a0rmSBWuVyQ0JrBcqQWB3Uh7kT6 2PXBjMJNPmKby/02FMiAi9NNvLahb7s1AjHYroCA= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-98334: wifi: mac80211: reset state when starting AP fails Date: Tue, 6 Oct 2026 10:47:15 +0200 Message-ID: <2026100616-CVE-2026-98334-e5bd@gregkh> X-Mailer: git-send-email 2.56.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3499; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=ps64io+4y9QcrAEuOcaxiNfpulMu8FdRTqk9bJ2EzDY=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlHtsp8N8++8GHZjoAD4ZXHvpdMufvYLXTirSt5165MC T6aOV1VuSOWhUGQiUFWTJHlyzaeo/srDil6GdqehpnDygQyhIGLUwAm8nkyw4IzD07rtPzx+bPU pC376qJFVepTJ99mmO+quHVTrty6jL3mRjc2nnnsPSWykxkA X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reset state when starting AP fails ieee80211_start_ap() can set enable_beacon (and beacon_int) and fail later, leaving it set forever. Scanning can then attempt to restore beaconing on such an interface, leading to: Oops: divide error: 0000 [#1] SMP KASAN NOPTI RIP: 0010:mac80211_hwsim_link_info_changed+0xca7/0xf00 Call Trace: drv_link_info_changed+0x413/0x860 net/mac80211/driver-ops.c:495 ieee80211_link_info_change_notify+0x24b/0x3c0 net/mac80211/main.c:427 ieee80211_offchannel_return+0x381/0x580 net/mac80211/offchannel.c:160 __ieee80211_scan_completed+0x993/0xe30 net/mac80211/scan.c:519 ieee80211_scan_work+0x472/0x2010 net/mac80211/scan.c:1193 cfg80211_wiphy_work+0x2b7/0x550 net/wireless/core.c:538 in hwsim. Also, cfg80211 then allows changing the interface type, and the off-channel path getgs confused about beaconing as well, leading to another warning: WARNING: net/mac80211/driver-ops.c:468 at drv_link_info_changed+0x583/0x880 ieee80211_link_info_change_notify+0x24b/0x3c0 net/mac80211/main.c:427 ieee80211_offchannel_stop_vifs+0x328/0x5c0 net/mac80211/offchannel.c:122 ieee80211_start_sw_scan net/mac80211/scan.c:583 [inline] __ieee80211_start_scan+0xfb6/0x1af0 net/mac80211/scan.c:882 Reset the state on failures to always have it correct. The Linux kernel CVE team has assigned CVE-2026-98334 to this issue. Affected and fixed versions =========================== Issue introduced in 3.9 with commit d6a83228823fc0cc8d79d95c9f0bf568b7317862 and fixed in 6.12.112 with commit d83da43e9b3b3b1bad99ac5a1065f1c63ad5fc32 Issue introduced in 3.9 with commit d6a83228823fc0cc8d79d95c9f0bf568b7317862 and fixed in 6.18.54 with commit 5d5ff5b36f5748a2a077f875a73ccb26860d3fcc Issue introduced in 3.9 with commit d6a83228823fc0cc8d79d95c9f0bf568b7317862 and fixed in 7.2.8 with commit 6eac225f59c1c2277ac74f8a716d6df0ba3b8d28 Issue introduced in 3.9 with commit d6a83228823fc0cc8d79d95c9f0bf568b7317862 and fixed in 7.3-rc4 with commit 3f28551d0241254a75626d868041c6340285088b Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-98334 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: net/mac80211/cfg.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/d83da43e9b3b3b1bad99ac5a1065f1c63ad5fc32 https://git.kernel.org/stable/c/5d5ff5b36f5748a2a077f875a73ccb26860d3fcc https://git.kernel.org/stable/c/6eac225f59c1c2277ac74f8a716d6df0ba3b8d28 https://git.kernel.org/stable/c/3f28551d0241254a75626d868041c6340285088b