CVE-2026-98337: Linux Kernel mac80211 Race Condition Vulnerability

CVE-2026-98337 Overview

CVE-2026-98337 is a race condition in the Linux kernel's mac80211 wireless subsystem. The flaw occurs when a Remain-on-Channel (ROC) work item is pending while a scan operation starts. A new ROC can be added to the list and picked up by the work handler, triggering a warning in ieee80211_start_next_roc at net/mac80211/offchannel.c:404.

The issue has been resolved upstream by preventing a ROC from starting if a scan has begun in between operations.

Critical Impact
The race between ROC work and scan completion triggers a kernel WARNING in the wireless stack, which can disrupt Wi-Fi operation on affected Linux systems using the mac80211 driver stack.

Affected Products

Linux kernel mac80211 wireless subsystem
Linux distributions shipping affected kernel versions prior to the stable backports
Wi-Fi drivers depending on mac80211 for ROC and scan operations

Discovery Timeline

2026-10-06 - CVE CVE-2026-98337 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-98337

Vulnerability Analysis

The vulnerability is a race condition [TOCTOU-class] in the Linux kernel's mac80211 offchannel handling. Remain-on-Channel (ROC) operations and scan operations both compete for the radio and are serialized through the ROC list and scan state.

A scan can only start when the ROC list is empty. However, the ROC work item itself may still be pending at that moment. Once the scan is in progress, a new ROC request can be queued onto the list. When the pending ROC work later runs, it will attempt to start the newly added ROC while a scan is active.

This violates the invariant checked in ieee80211_start_next_roc, producing a kernel warning emitted via the call path ieee80211_scan_work → __ieee80211_scan_completed → ieee80211_start_next_roc. The warning indicates an inconsistent state in the offchannel state machine.

Root Cause

The root cause is insufficient synchronization between the ROC work scheduler and the scan start logic. The code checks that the ROC list is empty when a scan begins, but it does not account for a ROC work item that is already queued and will execute asynchronously. The window between the scan starting and the ROC work running allows new ROC entries to be processed under invalid conditions.

Attack Vector

The condition is triggered through normal interaction with the Wi-Fi stack: concurrent scan requests and ROC-generating operations such as P2P discovery, action frame transmission, or management frame offloading. A local unprivileged workload able to issue scan and ROC-triggering operations can produce the race. No remote network attacker interaction is required to reach the warning path.

The vulnerability manifests as a WARN in net/mac80211/offchannel.c. See the upstream commits referenced below for the authoritative technical details and the applied fix.

Detection Methods for CVE-2026-98337

Indicators of Compromise

Kernel log entries containing WARNING: net/mac80211/offchannel.c:404 at ieee80211_start_next_roc
Stack traces showing __ieee80211_scan_completed, ieee80211_scan_work, and cfg80211_wiphy_work in the call path
Unexpected Wi-Fi scan or ROC failures correlated with warning timestamps

Detection Strategies

Monitor dmesg and /var/log/kern.log for mac80211 warnings related to ieee80211_start_next_roc
Audit running kernel versions across the fleet against the fixed stable commits
Correlate wireless subsystem warnings with workloads that heavily use P2P, scanning, or offchannel action frames

Monitoring Recommendations

Forward kernel ring buffer events to a centralized log pipeline and alert on mac80211 WARN signatures
Track Wi-Fi connection stability metrics on endpoints running affected kernels
Include kernel version inventory in configuration management reporting to confirm patch coverage

How to Mitigate CVE-2026-98337

Immediate Actions Required

Identify Linux endpoints and devices running kernels that include mac80211 without the upstream fix
Apply vendor-supplied kernel updates that incorporate the stable backports referenced in the CVE record
Reboot affected systems after patching to activate the updated kernel

Patch Information

The fix is available in the upstream Linux stable tree. Apply distribution kernel updates that include the following commits: Linux Kernel Commit 58b806f, Linux Kernel Commit 5dc8ec2, Linux Kernel Commit 733f0fd, and Linux Kernel Commit 81baab8. The fix prevents starting a queued ROC when a scan has begun in between operations.

Workarounds

Reduce the frequency of concurrent scan and ROC-generating workloads such as P2P discovery on unpatched systems
Disable Wi-Fi radios on systems where wireless connectivity is not required until the patched kernel is deployed
Where possible, use wired networking on affected hosts until the stable kernel update is applied

bash

# Verify running kernel version and check for the fix
uname -r

# Example (Debian/Ubuntu): update and install the latest kernel
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r | cut -d- -f3-)
sudo reboot

# Example (RHEL/Fedora): update kernel package
sudo dnf update kernel
sudo reboot