CVE-2026-98183
Linux: wifi: mac80211: avoid out-of-bounds read for empty PREQ elements
Linux LinuxOperating systemsCVSS
NoneNot scoredExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.16%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 3beddbd56946577478fd5e649f556aaaebe15b0aLinuxCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: avoid out-of-bounds read for empty PREQ elements
ieee80211_mesh_preq_size_ok() derives the location of the PREQ bottom fields before checking whether the element contains even the fixed header. ieee80211_mesh_hwmp_preq_get_bottom() reads the flags byte to account for the optional Address Extension field. Consequently, an empty PREQ element causes a one-byte read beyond its declared payload.
Move the helper call after both size checks, so the bottom fields are only accessed when they are present.
Text from CVE List
Affected versions 6
- Linuxaffected: 8b40b1d24a6099fe9fac8e207d4cb04ab5e0baae before 3beddbd56946577478fd5e649f556aaaebe15b0aCVE List
- Linuxaffected: 8b40b1d24a6099fe9fac8e207d4cb04ab5e0baae before e6031f02269c0f51cf67886d177f02bc300b47cdCVE List
- Linuxaffected: 7.2CVE List
- Linuxunaffected: all versions before 7.2CVE List
- Linuxunaffected: 7.2.8 through 7.2.*CVE List
- Linuxunaffected: 7.3CVE List