CVE-2026-98705 wifi: mac80211: account proxy paths against the mesh path limit

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: account proxy paths against the mesh path limit Proxy-path churn can drive the interface path counter negative and let later mesh path additions exceed MESHMAXMPATHS. meshpathfreercu decrements the interface mpath...

EUVD-2026-103959

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: account proxy paths against the mesh path limit Proxy-path churn can drive the interface path counter negative and let later mesh path additions exceed MESHMAXMPATHS. meshpathfreercu decrements the interface mpath...

CVE-2026-98705

The Linux kernel contains a vulnerability in the wifi: mac80211 component where proxy-path churn can drive the interface path counter into negative values. This occurs because mesh_path_free_rcu() decrements the counter for proxy paths, but mpp_path_add() fails to reserve a slot in that counter, ...

EUVD-2026-103958

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: keep fallback association elements alive Associating to a non-transmitted MBSSID profile reads freed memory while determining the operating channel and applying HT capabilities. When an association response omits...

CVE-2026-98704

The Linux kernel contains a vulnerability in the wifi: mac80211 component where associating with a non-transmitted MBSSID profile can result in a use-after-free condition. When an association response omits WMM, HT, or VHT information, the ieee80211_assoc_config_link() function parses cached BSS ...

CVE-2026-98704 wifi: mac80211: keep fallback association elements alive

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: keep fallback association elements alive Associating to a non-transmitted MBSSID profile reads freed memory while determining the operating channel and applying HT capabilities. When an association response omits...

CVE-2026-98704 wifi: mac80211: keep fallback association elements alive

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: keep fallback association elements alive Associating to a non-transmitted MBSSID profile reads freed memory while determining the operating channel and applying HT capabilities. When an association response omits...

CVE-2026-98703 wifi: mac80211: minstrel_ht: validate fixed rate index

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: minstrelht: validate fixed rate index The fixedrateidx debugfs file is a plain u32 attribute, so any value can be written to it. minstrelhtupdatestats then copies the value into mi-maxtprate and mi-maxprobrate, an...

CVE-2026-98703 wifi: mac80211: minstrel_ht: validate fixed rate index

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: minstrelht: validate fixed rate index The fixedrateidx debugfs file is a plain u32 attribute, so any value can be written to it. minstrelhtupdatestats then copies the value into mi-maxtprate and mi-maxprobrate, an...

CVE-2026-98703

The Linux kernel contains an out-of-bounds memory corruption vulnerability in the wifi: mac80211: minstrel_ht component. The fixed_rate_idx debugfs file accepts arbitrary u32 values, which are then used to index minstrel_mcs_groups[] and mi->groups[].rates[] arrays. Providing an out-of-bounds ...

EUVD-2026-103957

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: minstrelht: validate fixed rate index The fixedrateidx debugfs file is a plain u32 attribute, so any value can be written to it. minstrelhtupdatestats then copies the value into mi-maxtprate and mi-maxprobrate, an...

CVE-2026-98702 wifi: mac80211: reject invalid 320 MHz CSA bandwidth

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reject invalid 320 MHz CSA bandwidth The HT/VHT channel definition validator can receive a 320 MHz bandwidth indication from a received CSA frame on a non-6 GHz link. It warns for this unsupported width but...

CVE-2026-98702 wifi: mac80211: reject invalid 320 MHz CSA bandwidth

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reject invalid 320 MHz CSA bandwidth The HT/VHT channel definition validator can receive a 320 MHz bandwidth indication from a received CSA frame on a non-6 GHz link. It warns for this unsupported width but...

EUVD-2026-103956

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reject invalid 320 MHz CSA bandwidth The HT/VHT channel definition validator can receive a 320 MHz bandwidth indication from a received CSA frame on a non-6 GHz link. It warns for this unsupported width but...

CVE-2026-98702

The Linux kernel contains a vulnerability in the wifi: mac80211 component where the HT/VHT channel definition validator can receive a 320 MHz bandwidth indication from a CSA frame on a non-6 GHz link. The system warns about the unsupported width but proceeds with an uninitialized vht_operation.ch...

CVE-2026-98701 wifi: mac80211: release mesh path quota on failed additions

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: release mesh path quota on failed additions Repeated failed or duplicate mesh path additions can exhaust MESHMAXMPATHS while the path table holds fewer paths, which stops new paths to reachable destinations from...

CVE-2026-98701 wifi: mac80211: release mesh path quota on failed additions

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: release mesh path quota on failed additions Repeated failed or duplicate mesh path additions can exhaust MESHMAXMPATHS while the path table holds fewer paths, which stops new paths to reachable destinations from...

CVE-2026-98701

The Linux kernel contains a vulnerability in the wifi: mac80211 component where repeated failed or duplicate mesh path additions can exhaust the MESH_MAX_MPATHS quota. The root cause is that the mesh_path_add() function reserves a slot before allocation and insertion; however, if allocation fails...

EUVD-2026-103955

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: release mesh path quota on failed additions Repeated failed or duplicate mesh path additions can exhaust MESHMAXMPATHS while the path table holds fewer paths, which stops new paths to reachable destinations from...

CVE-2026-98700 wifi: mac80211: set info->band for 802.3 encap offload frames

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: set info-band for 802.3 encap offload frames Unlike the 802.11 TX paths, ieee802118023xmit does not set info-band from the channel context on non-MLD interfaces. It stays at 0, so ieee80211gettxrates uses the wron...