All vulnerabilities
CVE-2026-98340

Linux: wifi: cfg80211: only group hidden BSSes with beacon entries

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 7% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4cd6a518ce7527284bbc9baab5fa2453a7d477c2Also 74ed0d992f392c75e1969415527e06df3f7a4034, 3658093df69849daf4f813a8f087f358e13be203 and 5 moreCVE List
Published6 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 4cd6a518ce7527284bbc9baab5fa2453a7d477c2LinuxCVE List
  • 74ed0d992f392c75e1969415527e06df3f7a4034LinuxCVE List
  • 3658093df69849daf4f813a8f087f358e13be203LinuxCVE List
  • 73365b81630b57e1a1f9d50dc87281797855c2acLinuxCVE List
  • 7405dd19bda4537a2843637d8d7bed1efd4776cfLinuxCVE List
  • 86235be788094131912e9bd8412b358d91d99f49LinuxCVE List
Show all 8 fixed versions
  • 332ea1502c46f53375cb109fa82bfaff818f3a41LinuxCVE List
  • 068843ed0902c552a13860c5ec6b2ca65b57a065LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: only group hidden BSSes with beacon entries

When a probe response for an unknown BSS comes in, __cfg80211_bss_update() looks for an existing entry with the same BSSID and a hidden (zero-length or NUL-filled) SSID, and if it finds one it groups them, using the beacon IEs from the existing entry.

But that could find another entry without a beacon, if it was also from a probe response (with SSID), so there's a group without beacon elements.

If a beacon with a hidden SSID for that BSSID arrives later, cfg80211_combine_bsses() goes looking for the probe response entries that belong to it - i.e. entries with the same BSSID and channel that have no beacon IEs - and finds those two. They are already grouped with each other, so it hits its

WARN_ON_ONCE(bss->pub.hidden_beacon_bss) WARN_ON_ONCE(!list_empty(&bss->hidden_list))

which are there because an entry without beacon elements is not supposed to be part of a group yet.

Only combine entries when a beacon was already received, ones that are kept separate will be combined when a beacon arrives.

Text from CVE List

Affected versions 18

  • Linuxaffected: 4593c4cbe1c96b3995727dc42f6aa103f4ff5afc before 4cd6a518ce7527284bbc9baab5fa2453a7d477c2CVE List
  • Linuxaffected: 4593c4cbe1c96b3995727dc42f6aa103f4ff5afc before 74ed0d992f392c75e1969415527e06df3f7a4034CVE List
  • Linuxaffected: 4593c4cbe1c96b3995727dc42f6aa103f4ff5afc before 3658093df69849daf4f813a8f087f358e13be203CVE List
  • Linuxaffected: 4593c4cbe1c96b3995727dc42f6aa103f4ff5afc before 73365b81630b57e1a1f9d50dc87281797855c2acCVE List
  • Linuxaffected: 4593c4cbe1c96b3995727dc42f6aa103f4ff5afc before 7405dd19bda4537a2843637d8d7bed1efd4776cfCVE List
  • Linuxaffected: 4593c4cbe1c96b3995727dc42f6aa103f4ff5afc before 86235be788094131912e9bd8412b358d91d99f49CVE List
  • Linuxaffected: 4593c4cbe1c96b3995727dc42f6aa103f4ff5afc before 332ea1502c46f53375cb109fa82bfaff818f3a41CVE List
  • Linuxaffected: 4593c4cbe1c96b3995727dc42f6aa103f4ff5afc before 068843ed0902c552a13860c5ec6b2ca65b57a065CVE List
  • Linuxaffected: 3.9CVE List
  • Linuxunaffected: all versions before 3.9CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8