CVE-2026-98329: Linux Kernel mac80211 DOS Vulnerability

CVE-2026-98329 Overview

CVE-2026-98329 affects the Linux kernel's mac80211 wireless subsystem. The flaw allows frames injected on a monitor interface to request a bandwidth wider than the active channel context (chanctx). The mac80211 layer passes the radiotap-specified bandwidth down to the driver without verifying it against the operational bandwidth. In the hwsim driver, this triggers a WARN_ON when the requested bandwidth exceeds the configured channel width. The upstream fix drops such frames outright because they cannot be transmitted.

Critical Impact
Local users with privileges to inject frames on a monitor interface can trigger kernel warnings and inconsistent driver state through oversized bandwidth requests in radiotap headers.

Affected Products

Linux kernel mac80211 subsystem (upstream stable branches receiving commits 73f48f7, a5c715e, c697185, and e14bf37)
Wireless drivers consuming the radiotap bandwidth field, including mac80211_hwsim
Linux distributions shipping affected kernel versions prior to the backported fix

Discovery Timeline

2026-10-06 - CVE-2026-98329 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-98329

Vulnerability Analysis

The mac80211 subsystem accepts frames injected through a monitor-mode interface and honors the radiotap transmission parameters provided by userspace. One of those parameters is the transmission bandwidth. The subsystem forwards the requested bandwidth to the underlying driver without reconciling it with the current channel context width. When the requested bandwidth exceeds the configured channel width, drivers reach an unexpected state. In mac80211_hwsim, the condition fires the WARN_ON(hwsim_get_chanwidth(bw) > hwsim_get_chanwidth(confbw)) check and produces a kernel warning. Real hardware drivers may react differently, including configuration faults or dropped operational state. The resolved patch validates the injected bandwidth against the active channel context and discards frames that exceed it, preventing the invalid request from reaching the driver.

Root Cause

The root cause is missing input validation between the radiotap bandwidth field supplied by userspace and the operational channel context managed by mac80211. The subsystem trusted the injected value and passed it unchanged to the driver layer.

Attack Vector

Exploitation requires local access to a system with a wireless interface placed in monitor mode and the capability to inject frames. An attacker crafts a radiotap header requesting a bandwidth wider than the operational channel width. The malformed frame reaches the driver and triggers the inconsistent state. See the upstream commits (73f48f7, a5c715e, c697185, e14bf37) for the exact validation logic added.

Detection Methods for CVE-2026-98329

Indicators of Compromise

Kernel log entries containing WARN_ON traces originating from mac80211_hwsim or other wireless drivers after frame injection activity
Unexpected monitor-mode interfaces (mon0, wlanXmon) created on production hosts that do not perform wireless packet capture
Processes invoking CAP_NET_ADMIN-privileged tooling such as aircrack-ng suites, scapy, or custom raw-socket utilities on wireless interfaces

Detection Strategies

Collect dmesg and /var/log/kern.log output and alert on WARN_ON stack frames referencing ieee80211_monitor_start_xmit or hwsim_get_chanwidth
Audit iw dev output across the fleet to inventory interfaces operating in monitor mode
Review auditd records for setsockopt and ioctl calls that configure radiotap transmission on wireless devices

Monitoring Recommendations

Forward kernel ring buffer events to centralized logging and build alerts for recurring mac80211 warnings
Track changes to wireless interface type using NETLINK_ROUTE events and flag transitions into monitor mode
Baseline which hosts legitimately require monitor-mode operation and investigate deviations

How to Mitigate CVE-2026-98329

Immediate Actions Required

Apply the stable kernel update that includes commits 73f48f7, a5c715e, c697185, and e14bf37 from your distribution vendor
Restrict CAP_NET_ADMIN to administrative accounts and remove unnecessary privileges from service users
Unload the mac80211_hwsim module on production hosts that do not require simulated wireless testing

Patch Information

The fix lives in the upstream mac80211 tree. Rebase or install a kernel that includes commit 73f48f7, commit a5c715e, commit c697185, and commit e14bf37. The patch drops injected frames whose requested bandwidth exceeds the active channel context.

Workarounds

Disable monitor-mode interfaces where they are not required for operations
Blacklist the mac80211_hwsim kernel module on systems that do not use simulated wireless testing
Limit interactive shell access on hosts with wireless hardware to reduce the exposure to local frame injection

bash

# Example: blacklist the hwsim module and remove monitor interfaces
echo 'blacklist mac80211_hwsim' | sudo tee /etc/modprobe.d/blacklist-hwsim.conf
sudo iw dev mon0 del 2>/dev/null
sudo sysctl -w kernel.dmesg_restrict=1