CVE-2026-98183 wifi: mac80211: avoid out-of-bounds read for empty PREQ elements
An out-of-bounds read in the Linux kernel's mac80211 module allows attackers to cause a denial of service or leak information via crafted Wi-Fi mesh frames.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98183?
CVE-2026-98183 is a memory corruption vulnerability in Linux, published on 6 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: avoid out-of-bounds read for empty PREQ elements
ieee80211_mesh_preq_size_ok() derives the location of the PREQ bottom fields before checking whether the element contains even the fixed header. ieee80211_mesh_hwmp_preq_get_bottom() reads the flags byte to account for the optional Address Extension field. Consequently, an empty PREQ element causes a one-byte read beyond its declared payload.
Move the helper call after both size checks, so the bottom fields are only accessed when they are present.
Which versions are affected by CVE-2026-98183?
How do I fix CVE-2026-98183?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-98183 being exploited?
There is no known exploitation of CVE-2026-98183 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-98183, GHSA-867h-2x92-cj79, UBUNTU-CVE-2026-98183.