{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-98824 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-98824 is a memory corruption vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-98824 and fix it if it is affected.\n\nWhat it is: CVE-2026-98824 is a memory corruption vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-98824 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-98824/ (Markdown: https://insights.sbomify.com/CVE-2026-98824/index.md)","id":"CVE-2026-98824","markdown":"https://insights.sbomify.com/CVE-2026-98824/index.md","name":"CVE-2026-98824","record":{"aliases":["AZL-109313","BELL-CVE-2026-98824","DEBIAN-CVE-2026-98824","GHSA-x3j6-9gf8-hfpp","UBUNTU-CVE-2026-98824"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service","code_execution"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel Wi-Fi","requires_auth":"none","summary":"Malformed Wi-Fi TX status metadata can cause out-of-bounds indexing in the Linux kernel, potentially leading to memory corruption or denial of service.","user_interaction":"not_required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: validate TX status rate metadata\n\nminstrel_ht_tx_status() converts the HT/VHT rate reported in a TX status\ninto a group and rate index and uses those to index the minstrel_ht rate\ntables.  The existing validation only checked that an entry was present\nand had tries recorded; it did not check that the reported MCS, spatial\nstream count and bandwidth are representable by the tables, so malformed\nmetadata passed to minstrel_ht_get_stats() or\nminstrel_ht_ri_get_stats() could be used as an out-of-bounds index.\n\nValidate the rate metadata in the common TX status path instead of only\nin minstrel_ht, since the values are used by more than rate control.\nThe legacy ieee80211_tx_rate array and the rate_info based entries are\nsanitized in ieee80211_tx_status_ext() and ieee80211_tx_rate_update()\nbefore any consumer runs: an entry that does not describe a valid rate\nfor its encoding is dropped.  minstrel_ht keeps the checks that depend\non its own tables, i.e. the supported number of spatial streams, the MCS\ngroup size and the supported bandwidths.\n\nThis does not take away the driver's responsibility to report sane\nvalues, it only prevents a single bad report from corrupting mac80211\nstate.  No WARN_ON() is added: with panic_on_warn a driver bug would\notherwise turn into a denial of service.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"wifi: mac80211: validate TX status rate metadata","id":"CVE-2026-98824","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"memory_corruption","year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe()","id":"CVE-2026-98825"},"packages":[],"prev":{"headline":"wifi: cfg80211: preserve hidden-group beacon IE ownership","id":"CVE-2026-98823"},"products":["Linux"],"published":"2026-10-18","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"Malformed Wi-Fi TX status metadata can cause out-of-bounds indexing in the Linux kernel, potentially leading to memory corruption or denial of service.","url":"https://insights.sbomify.com/CVE-2026-98824/"}