CVE-2026-98703

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: minstrel_ht: validate fixed rate index

The fixed_rate_idx debugfs file is a plain u32 attribute, so any value

can be written to it. minstrel_ht_update_stats() then copies the value

into mi->max_tp_rate[] and mi->max_prob_rate, and

minstrel_ht_set_rate() uses MI_RATE_GROUP()/MI_RATE_IDX() to index

minstrel_mcs_groups[] (42 entries) and mi->groups[].rates[] (10 entries)

with it.

Writing e.g. 65535 selects group 4095 and rate index 15, far outside

both arrays. The out-of-bounds entries are dereferenced and updated as

struct minstrel_rate_stats (retry counts, etc.), so the invalid index

corrupts adjacent kernel memory. With CONFIG_UBSAN_BOUNDS the access is

reported as an array-index-out-of-bounds in minstrel_ht_set_rate().

Only a valid group/rate pair, or U32_MAX to disable fixed rate

processing, can be used safely, so reject any other value when the

debugfs file is written.

The file is only reacha

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References