CVE-2026-98329: wifi: mac80211: don't allow injecting frames wider than the chanctx

Published Oct 6, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: don't allow injecting frames wider than the chanctx

Frames injected on a monitor interface can carry a radiotap field requesting a bandwidth, which mac80211 passes down to the driver regardless of the the actual operational bandwidth.

If the bandwidth requested is too wide, that triggers a warning in hwsim:

WARNON(hwsimgetchanwidth(bw) > hwsimgetchanwidth(confbw))

Drop such frames entirely instead since they cannot be sent.

Affected Software

1 affected component

Linux Linux kernel

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Compensating control
Drop injected monitor-interface frames that request a bandwidth wider than the channel context, since they cannot be sent.

Event History

Oct 6, 2026

CVE Published

via MITRE·08:46 AM

Data Sourced

via MITRE·08:46 AM

Description

Data Sourced

via NVD·09:18 AM

Description

Frequently Asked Questions

Who is exposed to this issue?

Systems using the Linux kernel with mac80211 Wi-Fi support are exposed when frames can be injected through a monitor interface. The issue involves injected frames that request a bandwidth wider than the active channel context.

What does an attacker need to trigger the issue?

The attacker needs the ability to inject frames on a monitor interface and include a radiotap bandwidth request exceeding the actual operational bandwidth. mac80211 would otherwise pass that request to the driver.

What can be done if the fix cannot be applied immediately?

Restrict access to monitor interfaces and prevent untrusted users or processes from injecting Wi-Fi frames. This removes the described path for supplying an oversized radiotap bandwidth request.

How can administrators identify potentially affected activity?

A warning from hwsim indicating that the requested channel width exceeds the configured bandwidth is an indicator of the condition. The warning compares the requested bandwidth with the active channel-context bandwidth.

CVE-2026-98329: wifi: mac80211: don't allow injecting frames wider than the chanctx

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to trigger the issue?

What can be done if the fix cannot be applied immediately?

How can administrators identify potentially affected activity?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to trigger the issue?

What can be done if the fix cannot be applied immediately?

How can administrators identify potentially affected activity?