# CVE-2026-98406: wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver

> A local attacker can trigger a kernel warning and potential denial of service by issuing a specific ioctl during Wi-Fi interface state transitions.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 14 Oct 2026
- **Updated:** 19 Oct 2026
- **Also known as:** AZL-108135, BELL-CVE-2026-98406, DEBIAN-CVE-2026-98406, GHSA-9hw7-47p3-c6fj, UBUNTU-CVE-2026-98406

## What is CVE-2026-98406?

CVE-2026-98406 is a denial of service vulnerability in Linux, published on 14 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver

ieee80211_set_bitrate_mask() checks if the interface is running via
ieee80211_sdata_running(), but it does not check if the interface is
still present in the driver.

When sdata is running but IEEE80211_SDATA_IN_DRIVER is not set, the
call reaches drv_set_bitrate_mask() in driver-ops.h which hits

  wlan1: Failed check-sdata-in-driver check, flags: 0x0
  WARNING: net/mac80211/driver-ops.h:884 at drv_set_bitrate_mask

Syzkaller triggers this via wext SIOCSIWRATE ioctl. The Call Trace shows
wext_ioctl_dispatch() in wext-core.c dispatching the ioctl, calling
ioctl_standard_call() for SIOCSIWRATE, which calls cfg80211_wext_siwrate()
in wext-compat.c. That builds a bitrate mask and calls
rdev_set_bitrate_mask() which ends up in ieee80211_set_bitrate_mask() in
cfg.c. The interface is marked running via SDATA_STATE_RUNNING but
flags is 0, so check_sdata_in_driver() fails.

When the interface is being torn down, or when wext ioctl is issued
during interface bringup before drv_add_interface() sets IN_DRIVER, the
running check passes while IN_DRIVER is clear.

Check IEEE80211_SDATA_IN_DRIVER in ieee80211_set_bitrate_mask() before
calling the driver, returning -ENETDOWN. This avoids the WARN_ONCE in
driver-ops.h and matches other cfg.c operations that bail early when not
in driver.

This change should be safe because wiphy mutex is held in
cfg80211_wext_siwrate() via guard(wiphy), and IN_DRIVER is set/cleared
under RTNL and wiphy paths in drv_add_interface() and
drv_remove_interface() in driver-ops.c, so the check is race-free
against driver add/remove. Returning -ENETDOWN is the same error other
not-running paths use and does not introduce new locking.

[also add second syzbot report]

## Which versions are affected by CVE-2026-98406?


## How do I fix CVE-2026-98406?

Apply the vendor's patch.

## Is CVE-2026-98406 being exploited?

There is no known exploitation of CVE-2026-98406 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-98406 and fix it if it is affected.

What it is: CVE-2026-98406 is a denial of service vulnerability in Linux, published on 14 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-98406 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-98406/ (Markdown: https://insights.sbomify.com/CVE-2026-98406/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-98406
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-98406
- OSV: https://osv.dev/vulnerability/CVE-2026-98406

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-98406/
Summaries are generated and may contain mistakes; the official description above is the record.