CVE-2026-98340 wifi: cfg80211: only group hidden BSSes with beacon entries
A logic error in Linux kernel Wi-Fi handling allows attackers to trigger kernel warnings and potential instability via crafted probe responses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98340?
CVE-2026-98340 is a denial of service vulnerability in Linux, published on 6 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: only group hidden BSSes with beacon entries
When a probe response for an unknown BSS comes in, __cfg80211_bss_update() looks for an existing entry with the same BSSID and a hidden (zero-length or NUL-filled) SSID, and if it finds one it groups them, using the beacon IEs from the existing entry.
But that could find another entry without a beacon, if it was also from a probe response (with SSID), so there's a group without beacon elements.
If a beacon with a hidden SSID for that BSSID arrives later, cfg80211_combine_bsses() goes looking for the probe response entries that belong to it - i.e. entries with the same BSSID and channel that have no beacon IEs - and finds those two. They are already grouped with each other, so it hits its
WARN_ON_ONCE(bss->pub.hidden_beacon_bss) WARN_ON_ONCE(!list_empty(&bss->hidden_list))
which are there because an entry without beacon elements is not supposed to be part of a group yet.
Only combine entries when a beacon was already received, ones that are kept separate will be combined when a beacon arrives.
Which versions are affected by CVE-2026-98340?
How do I fix CVE-2026-98340?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-98340 being exploited?
There is no known exploitation of CVE-2026-98340 in the wild and no public exploit code.
Sources
Also known as AZL-106179, BELL-CVE-2026-98340, DEBIAN-CVE-2026-98340, GHSA-84vw-9582-fhpx, UBUNTU-CVE-2026-98340.