CVE-2026-98329: wifi: mac80211: don't allow injecting frames wider than the chanctx
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: don't allow injecting frames wider than the chanctx
Frames injected on a monitor interface can carry a radiotap field requesting a bandwidth, which mac80211 passes down to the driver regardless of the the actual operational bandwidth.
If the bandwidth requested is too wide, that triggers a warning in hwsim:
WARNON(hwsimgetchanwidth(bw) > hwsimgetchanwidth(confbw))
Drop such frames entirely instead since they cannot be sent.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.112 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.54 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.8 - Compensating control
Drop frames injected on a monitor interface when the radiotap-requested bandwidth is wider than the operational channel context, since such frames cannot be sent.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the Linux kernel with mac80211 Wi-Fi support are exposed when frames can be injected through a monitor interface. The issue involves injected frames that request a bandwidth wider than the active channel context.
What does an attacker need to trigger the issue?
The attacker needs the ability to inject frames on a monitor interface and include a radiotap bandwidth request exceeding the actual operational bandwidth. mac80211 would otherwise pass that request to the driver.
What can be done if the fix cannot be applied immediately?
Restrict access to monitor interfaces and prevent untrusted users or processes from injecting Wi-Fi frames. This removes the described path for supplying an oversized radiotap bandwidth request.
How can administrators identify potentially affected activity?
A warning from hwsim indicating that the requested channel width exceeds the configured bandwidth is an indicator of the condition. The warning compares the requested bandwidth with the active channel-context bandwidth.