CVE-2026-98406

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver

ieee80211_set_bitrate_mask() checks if the interface is running via

ieee80211_sdata_running(), but it does not check if the interface is

still present in the driver.

When sdata is running but IEEE80211_SDATA_IN_DRIVER is not set, the

call reaches drv_set_bitrate_mask() in driver-ops.h which hits

wlan1: Failed check-sdata-in-driver check, flags: 0x0

WARNING: net/mac80211/driver-ops.h:884 at drv_set_bitrate_mask

Syzkaller triggers this via wext SIOCSIWRATE ioctl. The Call Trace shows

wext_ioctl_dispatch() in wext-core.c dispatching the ioctl, calling

ioctl_standard_call() for SIOCSIWRATE, which calls cfg80211_wext_siwrate()

in wext-compat.c. That builds a bitrate mask and calls

rdev_set_bitrate_mask() which ends up in ieee80211_set_bitrate_mask() in

cfg.c. The interface is marked running via SDATA_STATE_RUNNING but

flags is 0, so check_sdata

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References