Bug 2559545 (CVE-2026-98891)

Summary:	CVE-2026-98891 kernel: wifi: mac80211: validate deauth frame length before reason access
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's mac80211 wireless networking subsystem. An adjacent attacker within wireless network range can trigger a Denial of Service (DoS) by sending a malformed or truncated deauthentication frame. The subsystem accesses the frame's reason code before verifying that the received frame contains the required data length, causing an out-of-bounds memory read that can crash the system.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-23 11:52:11 UTC

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: validate deauth frame length before reason access

ieee80211_rx_mgmt_deauth() reads the deauth reason code before checking
that the fixed field is actually present in the received frame.

Validate the deauth frame length first and only then read the reason
code.

Comment 1 Mauro Matteo Cascella 2026-10-26 13:33:01 UTC

Upstream advisory:
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98891.mbox