CVE-2026-98328 Overview
CVE-2026-98328 is a Linux kernel vulnerability in the mac80211 wireless subsystem. The flaw affects how the kernel calculates the length of scan information elements when building Wi-Fi probe requests. The HE 6 GHz Band Capability element was omitted from the scan_ies_len calculation, even though it is included in probe requests for every band when 6 GHz is supported.
When the buffer is undersized, building the probe request elements fails and triggers the WARN_ON in __ieee80211_start_scan(). This produces kernel warnings and can prevent Wi-Fi scanning from completing on affected systems.
Critical Impact
Wi-Fi scan operations can fail on systems supporting 6 GHz High Efficiency (HE) bands, degrading wireless connectivity and generating kernel warnings.
Affected Products
- Linux kernel versions containing the mac80211 scan handling code prior to the referenced stable commits
- Distributions shipping kernels with HE 6 GHz Wi-Fi support (Wi-Fi 6E)
- Wireless drivers that depend on mac80211 for probe request construction
Discovery Timeline
- 2026-10-06 - CVE-2026-98328 published to the National Vulnerability Database
- 2026-10-06 - Last updated in NVD database
Technical Details for CVE-2026-98328
Vulnerability Analysis
The vulnerability resides in the Linux kernel mac80211 layer, which handles IEEE 802.11 management frames in software for many wireless drivers. During scan initiation, the kernel pre-computes the total length of information elements (scan_ies_len) that will appear in outgoing probe requests. This value is used to allocate a buffer that the driver and mac80211 later populate with each element.
The HE 6 GHz Band Capability element is appended to probe requests on every band whenever the device supports 6 GHz operation. The length accounting routine did not include this element in its total. As a result, the allocated buffer was too small for the actual element set, causing probe request construction to fail and triggering the WARN_ON safety check inside __ieee80211_start_scan().
The impact is primarily a denial of service against local Wi-Fi scanning on 6 GHz capable systems. Repeated scan failures can also flood kernel logs with warning traces, consuming resources and complicating troubleshooting.
Root Cause
The root cause is an input validation and boundary condition error in the scan element length calculation. The HE 6 GHz Band Capability element size was not added to scan_ies_len, producing an undersized buffer that could not accommodate the full probe request element set when 6 GHz support was active.
Attack Vector
The condition is triggered during normal Wi-Fi scanning on hardware supporting 6 GHz. No network-based attacker interaction is required for the warning to appear. The practical effect is scan failure and kernel warning output rather than memory corruption, because the WARN_ON guard aborts the element construction before overflow occurs.
No verified proof-of-concept or exploit code is available in the referenced sources. The fix is distributed across the stable kernel commits 8659bd6, 9d83c08, ad5bd0f, be7bfde, cd54bf3, and db19d54.
Detection Methods for CVE-2026-98328
Indicators of Compromise
- Kernel log entries containing WARN_ON traces originating from __ieee80211_start_scan()
- Repeated failures of user-space scan requests from tools such as iw, wpa_supplicant, or NetworkManager on 6 GHz capable adapters
- dmesg output referencing mac80211 probe request construction failures
Detection Strategies
- Query installed kernel versions across the fleet and compare against the fixed stable release containing commit db19d54 or the backported equivalents
- Parse journalctl -k and dmesg output for ieee80211_start_scan warning signatures on endpoints with Wi-Fi 6E hardware
- Monitor wireless subsystem health counters for scan failure rate increases following kernel upgrades
Monitoring Recommendations
- Forward kernel ring buffer events to a centralized log pipeline to flag recurring mac80211 warnings
- Track package inventory for linux-image or vendor kernel package versions on Linux endpoints and servers with wireless NICs
- Correlate wireless connectivity support tickets with kernel version and 6 GHz adapter presence
How to Mitigate CVE-2026-98328
Immediate Actions Required
- Apply the vendor-provided kernel update that incorporates one of the stable commits listed in the references
- Reboot affected systems after kernel installation to load the patched mac80211 module
- Verify fix application by confirming scan operations complete without WARN_ON traces on 6 GHz hardware
Patch Information
The fix adds the HE 6 GHz Band Capability element size to scan_ies_len, ensuring the probe request buffer is large enough. Patched kernels are available through the following upstream references: Kernel Commit 8659bd6, Kernel Commit 9d83c08, Kernel Commit ad5bd0f, Kernel Commit be7bfde, Kernel Commit cd54bf3, and Kernel Commit db19d54. Linux distribution maintainers typically backport these commits into supported stable kernel series.
Workarounds
- Disable 6 GHz band operation on affected adapters through driver parameters or regulatory configuration where supported
- Restrict Wi-Fi scanning to the 2.4 GHz and 5 GHz bands via wpa_supplicant or NetworkManager profile configuration until a patched kernel is deployed
- Use a wired network interface on affected hosts if wireless scanning cannot be stabilized
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.