# CVE-2026-98703: wifi: mac80211: minstrel_ht: validate fixed rate index

> A local attacker with root access can corrupt kernel memory via an out-of-bounds write in the minstrel_ht debugfs interface, potentially leading to code execution.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** An administrator
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 18 Oct 2026
- **Updated:** 21 Oct 2026
- **Also known as:** AZL-109382, BELL-CVE-2026-98703, DEBIAN-CVE-2026-98703, GHSA-h4f8-3q7w-49pw, UBUNTU-CVE-2026-98703

## What is CVE-2026-98703?

CVE-2026-98703 is a memory corruption vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: minstrel_ht: validate fixed rate index

The fixed_rate_idx debugfs file is a plain u32 attribute, so any value
can be written to it.  minstrel_ht_update_stats() then copies the value
into mi->max_tp_rate[] and mi->max_prob_rate, and
minstrel_ht_set_rate() uses MI_RATE_GROUP()/MI_RATE_IDX() to index
minstrel_mcs_groups[] (42 entries) and mi->groups[].rates[] (10 entries)
with it.

Writing e.g. 65535 selects group 4095 and rate index 15, far outside
both arrays.  The out-of-bounds entries are dereferenced and updated as
struct minstrel_rate_stats (retry counts, etc.), so the invalid index
corrupts adjacent kernel memory.  With CONFIG_UBSAN_BOUNDS the access is
reported as an array-index-out-of-bounds in minstrel_ht_set_rate().

Only a valid group/rate pair, or U32_MAX to disable fixed rate
processing, can be used safely, so reject any other value when the
debugfs file is written.

The file is only reachable through a root-only debugfs mount, so this is
not a privilege boundary.  The out-of-bounds access is still a bug that
must not be reachable through a writable debugfs attribute.

## Which versions are affected by CVE-2026-98703?


## How do I fix CVE-2026-98703?

Apply the vendor's patch.

## Is CVE-2026-98703 being exploited?

There is no known exploitation of CVE-2026-98703 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-98703 and fix it if it is affected.

What it is: CVE-2026-98703 is a memory corruption vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-98703 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-98703/ (Markdown: https://insights.sbomify.com/CVE-2026-98703/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-98703
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-98703
- OSV: https://osv.dev/vulnerability/CVE-2026-98703

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-98703/
Summaries are generated and may contain mistakes; the official description above is the record.