All vulnerabilities
CVE-2026-98703

Linux: wifi: mac80211: minstrel_ht: validate fixed rate index

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in42aa9feb27b600809414a3c6b0c650bafba542a9Also 43082d604a9937b94ceb2e484403956d0f363324, 15fb9e3cea55fbc378261ce35a32b0f8828f0000CVE List
Published18 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 42aa9feb27b600809414a3c6b0c650bafba542a9LinuxCVE List
  • 43082d604a9937b94ceb2e484403956d0f363324LinuxCVE List
  • 15fb9e3cea55fbc378261ce35a32b0f8828f0000LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: minstrel_ht: validate fixed rate index

The fixed_rate_idx debugfs file is a plain u32 attribute, so any value can be written to it. minstrel_ht_update_stats() then copies the value into mi->max_tp_rate[] and mi->max_prob_rate, and minstrel_ht_set_rate() uses MI_RATE_GROUP()/MI_RATE_IDX() to index minstrel_mcs_groups[] (42 entries) and mi->groups[].rates[] (10 entries) with it.

Writing e.g. 65535 selects group 4095 and rate index 15, far outside both arrays. The out-of-bounds entries are dereferenced and updated as struct minstrel_rate_stats (retry counts, etc.), so the invalid index corrupts adjacent kernel memory. With CONFIG_UBSAN_BOUNDS the access is reported as an array-index-out-of-bounds in minstrel_ht_set_rate().

Only a valid group/rate pair, or U32_MAX to disable fixed rate processing, can be used safely, so reject any other value when the debugfs file is written.

The file is only reachable through a root-only debugfs mount, so this is not a privilege boundary. The out-of-bounds access is still a bug that must not be reachable through a writable debugfs attribute.

Text from CVE List

Affected versions 12

  • Linuxaffected: 24f7580e852b5472b51eea322bb78454df0054b8 before eebc70f132041b35da9ec74d5d395083125289b2CVE List
  • Linuxaffected: 24f7580e852b5472b51eea322bb78454df0054b8 before f8ab6ae1fa360b0191252677f41e781dcb0ffe6eCVE List
  • Linuxaffected: 24f7580e852b5472b51eea322bb78454df0054b8 before 42aa9feb27b600809414a3c6b0c650bafba542a9CVE List
  • Linuxaffected: 24f7580e852b5472b51eea322bb78454df0054b8 before 43082d604a9937b94ceb2e484403956d0f363324CVE List
  • Linuxaffected: 24f7580e852b5472b51eea322bb78454df0054b8 before 15fb9e3cea55fbc378261ce35a32b0f8828f0000CVE List
  • Linuxaffected: 3.1CVE List
  • Linuxunaffected: all versions before 3.1CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.56 through 6.18.*CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5