CVE-2026-98340wifi: cfg80211: only group hidden BSSes with beacon entries
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: only group hidden BSSes with beacon entries When a probe response for an unknown BSS comes in, __cfg80211_bss_update() looks for an existing entry with the same BSSID and a hidden (zero-length or NUL-filled) SSID, and if it finds one it groups them, using the beacon IEs from the existing entry. But that could find another entry without a beacon, if it was also from a probe response (with SSID), so there's a group without beacon elements. If a beacon with a hidden SSID for that BSSID arrives later, cfg80211_combine_bsses() goes looking for the probe response entries that belong to it - i.e. entries with the same BSSID and channel that have no beacon IEs - and finds those two. They are already grouped with each other, so it hits its WARN_ON_ONCE(bss->pub.hidden_beacon_bss) WARN_ON_ONCE(!list_empty(&bss->hidden_list)) which are there because an entry without beacon elements is not supposed to be part of a group yet. Only combine entries when a beacon was already received, ones that are kept separate will be combined when a beacon arrives.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 4593c4cbe1c96b3995727dc42f6aa103f4ff5afc builds before 4cd6a518ce7527284bbc9baab5fa2453a7d477c2; 4593c4cbe1c96b3995727dc42f6aa103f4ff5afc builds before 74ed0d992f392c75e1969415527e06df3f7a4034; from 4593c4cbe1c96b3995727dc42f6aa103f4ff5afc before 3658093df69849daf4f813a8f087f358e13be203; from 4593c4cbe1c96b3995727dc42f6aa103f4ff5afc before 73365b81630b57e1a1f9d50dc87281797855c2ac; from 4593c4cbe1c96b3995727dc42f6aa103f4ff5afc before 7405dd19bda4537a2843637d8d7bed1efd4776cf; from 4593c4cbe1c96b3995727dc42f6aa103f4ff5afc before 86235be788094131912e9bd8412b358d91d99f49; 4593c4cbe1c96b3995727dc42f6aa103f4ff5afc builds before 332ea1502c46f53375cb109fa82bfaff818f3a41; from 4593c4cbe1c96b3995727dc42f6aa103f4ff5afc before 068843ed0902c552a13860c5ec6b2ca65b57a065 | CNA record |
References
- https://git.kernel.org/stable/c/4cd6a518ce7527284bbc9baab5fa2453a7d477c2
- https://git.kernel.org/stable/c/74ed0d992f392c75e1969415527e06df3f7a4034
- https://git.kernel.org/stable/c/3658093df69849daf4f813a8f087f358e13be203
- https://git.kernel.org/stable/c/73365b81630b57e1a1f9d50dc87281797855c2ac
- https://git.kernel.org/stable/c/7405dd19bda4537a2843637d8d7bed1efd4776cf
- https://git.kernel.org/stable/c/86235be788094131912e9bd8412b358d91d99f49
- https://git.kernel.org/stable/c/332ea1502c46f53375cb109fa82bfaff818f3a41
- https://git.kernel.org/stable/c/068843ed0902c552a13860c5ec6b2ca65b57a065
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.