CVE-2026-98700 Overview
CVE-2026-98700 affects the Linux kernel's mac80211 wireless subsystem. The flaw sits in the ieee80211_8023_xmit() transmit path used for 802.3 encapsulation offload frames. Unlike the standard 802.11 TX paths, this function does not populate info->band from the channel context on non-MLD (Multi-Link Device) interfaces. The field remains at 0, causing ieee80211_get_tx_rates() to resolve rates against the wrong band. The upstream fix aligns behavior with ieee80211_build_hdr(): drop the frame when no channel context is present and leave the band at 0 on MLD interfaces.
Critical Impact
Incorrect band selection in Wi-Fi frame transmission can produce malformed rate control decisions, degraded connectivity, or frame handling errors on affected wireless drivers using 802.3 encapsulation offload.
Affected Products
- Linux kernel wireless subsystem (net/mac80211)
- Wi-Fi drivers that enable 802.3 encapsulation offload through mac80211
- Non-MLD wireless interfaces using the ieee80211_8023_xmit() TX path
Discovery Timeline
- 2026-10-18 - CVE-2026-98700 published to NVD
- 2026-10-21 - Last updated in NVD database
Technical Details for CVE-2026-98700
Vulnerability Analysis
The mac80211 subsystem provides two primary transmit paths for Wi-Fi frames. The native 802.11 path uses ieee80211_build_hdr(), which reads the active channel context and assigns the correct band to info->band on each outgoing frame. The 802.3 encapsulation offload path, implemented in ieee80211_8023_xmit(), bypasses that logic. On non-MLD interfaces the band field stays at its initialized value of 0, which corresponds to the 2.4 GHz band regardless of the interface's actual operating channel.
Downstream, ieee80211_get_tx_rates() consults info->band to select valid rate entries. When the field is wrong, the function returns rates that do not match the operating band, leading to incorrect rate control decisions and potential frame handling failures in the driver.
Root Cause
The root cause is a missing field assignment in the 802.3 encap offload transmit path. ieee80211_8023_xmit() never retrieved the band from the active channel context before handing the frame to rate selection. The patch brings its behavior in line with ieee80211_build_hdr() by looking up the channel context, dropping the frame if none exists, and leaving the band at 0 for MLD interfaces where per-link selection is handled separately.
Attack Vector
This is a local kernel defect triggered by normal Wi-Fi traffic on vulnerable drivers that use 802.3 encapsulation offload. There is no network-reachable attacker precondition described in the advisory, and no known public exploit exists. The EPSS score is 0.168%, consistent with low expected exploitation activity. Impact is primarily reliability and correctness of wireless transmission rather than code execution.
For source-level context, review the upstream commits referenced in the patch set: Kernel Git Commit 2d9c552, Kernel Git Commit 4febc02, Kernel Git Commit 6535f70, Kernel Git Commit 93c1b24, and Kernel Git Commit 9cedbfd.
Detection Methods for CVE-2026-98700
Indicators of Compromise
- No specific host-based or network IoCs are published for this issue; it manifests as incorrect wireless rate selection rather than attacker artifacts.
- Unexpected Wi-Fi rate control anomalies or dropped frames on drivers that enable IEEE80211_HW_SUPPORTS_TX_ENCAP_OFFLOAD.
Detection Strategies
- Inventory running kernel versions against the fixed commits referenced in the Linux stable tree to identify unpatched hosts.
- Audit loaded wireless drivers to flag those that use mac80211 with 802.3 encapsulation offload enabled on non-MLD interfaces.
- Correlate kernel ring buffer messages from mac80211 and the associated Wi-Fi driver that reference rate control failures or dropped TX frames.
Monitoring Recommendations
- Monitor dmesg and journal logs for repeated frame drop or rate control warnings from mac80211 on endpoints after a kernel update.
- Track kernel package versions across the Linux fleet to confirm distribution-level backports have been applied.
- Watch for Wi-Fi connectivity regressions reported by users on systems running kernels released before the fix date.
How to Mitigate CVE-2026-98700
Immediate Actions Required
- Apply the vendor kernel update that includes the mac80211 fix for ieee80211_8023_xmit() as soon as it is available through your Linux distribution.
- Prioritize patching endpoints and access-point hosts that rely on wireless drivers with 802.3 encapsulation TX offload.
- Reboot patched systems to ensure the updated mac80211 module is loaded.
Patch Information
The upstream fix sets info->band from the channel context in ieee80211_8023_xmit(), drops the frame if no channel context exists, and leaves the band at 0 on MLD interfaces. The change is present in the following stable commits: 2d9c5525bbc1, 4febc02cd02f, 6535f7084d95, 93c1b247224a, and 9cedbfde1450. Consume the fix through your distribution's kernel update channel.
Workarounds
- Where supported by the driver, disable 802.3 encapsulation TX offload so frames follow the native 802.11 TX path that correctly sets info->band.
- Restrict affected systems to the 2.4 GHz band if operationally acceptable, since the unset info->band value defaults to that band.
- Prefer the native 802.11 TX path on systems that cannot be rebooted immediately until the kernel update is applied.
# Verify running kernel version and reload the Wi-Fi driver after patching
uname -r
modinfo mac80211 | grep -E '^(version|filename):'
sudo modprobe -r <wifi_driver_module> && sudo modprobe <wifi_driver_module>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
