Linux Kernel: Warning in cfg80211 BSS entry handling after channel switch
Summary
A flaw in the cfg80211 Wi-Fi stack of the Linux kernel allows stale BSS entries of a different BSS type to remain in place when an associated access point switches channels. The following rehash then triggers a kernel WARN_ON, which can cause a kernel warning and a possible Wi-Fi disconnect. The condition can be triggered by a rogue access point or device within radio range, without authentication or user interaction. The CNA rates the issue 8.8, but the verified effect described by the sources is limited to warnings and disconnects, with no evidence of code execution or data theft.
Affected
- Linux kernel from commit 0afd425b1b64 (introduced in 5.4) until the fixed stable releases
- Affects only systems with cfg80211-based Wi-Fi
- Distribution kernels: unknown for your specific distribution, check its security tracker
Fixed in
- Upstream stable kernels 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54 and 7.2.8 (and later)
- Distribution fixed package versions: unknown, check the vendor advisory
Workaround
- No vendor-documented workaround.
- Disabling Wi-Fi or affected drivers on exposed devices may be an option; this has not been verified.
Exploitation
- No public proof-of-concept or confirmed exploitation known.
- Not listed in CISA KEV.
- The bug was found through syzbot-style fuzzing and patch discussion.
Our recommendation
- Inventory Linux systems and devices that use Wi-Fi.
- Install the kernel update from your distribution, or a stable kernel from your branch, as soon as available.
- Prioritise laptops, IoT and embedded devices in open or shared Wi-Fi environments.
- Servers connected only by Ethernet are lower priority.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Stable kernel commit 0aa44982125c86b47961be5ac1c82eddab8080f3 git.kernel.org
- Stable kernel commit 6ef87a853327434ae1cd9c5a2c27a557fb4047fc git.kernel.org
- OpenCVE CVE-2026-98339 app.opencve.io
- VulDB 414260 vuldb.com
- Techveda Linux kernel CVEs 10 Oct 2026 www.techveda.live
- SUSE CVE record via Vulners vulners.com
- Debian CVE record via Vulners vulners.com
- OSV Debian CVE-2026-98339 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 22:22.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't filter by BSS type when removing stale entries When an assoc AP switches to a channel that already has a BSS entry, cfg80211_update_assoc_bss_entry() removes that entry before rehashing the real one, since the two would otherwise collide in the BSS rbtree. The lookup for that entry also required it to match the connection's BSS type, so an entry advertising e.g. the IBSS capability bit was left in place, and the following cfg80211_rehash_bss() then ran into it: WARN_ON(!cmp) Changing the type shouldn't really happen, but can be triggered by a rogue AP/device, so drop the check and remove any entries matching the comparison.
NVD references (8)
- https://git.kernel.org/stable/c/0aa44982125c86b47961be5ac1c82eddab8080f3
- https://git.kernel.org/stable/c/1380ee3a202dbb9f8e8b3c3b87eb410450d57799
- https://git.kernel.org/stable/c/64e23a36d8f04811372365b44cfca325f8e0f4bb
- https://git.kernel.org/stable/c/65fdb973bd905bc3f5cb045a04c1828f2d2a7e24
- https://git.kernel.org/stable/c/6d2fd26185678038ef2ea11dd4d2e6eccbf2dd25
- https://git.kernel.org/stable/c/6ef87a853327434ae1cd9c5a2c27a557fb4047fc
- https://git.kernel.org/stable/c/b377e1000d963e7182a987082b4b06580bd7ac84
- https://git.kernel.org/stable/c/fb445ec7480da5d2b82bf681e3b4313603722729
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.