CVE-2026-98340: wifi: cfg80211: only group hidden BSSes with beacon entries
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: only group hidden BSSes with beacon entries
When a probe response for an unknown BSS comes in, cfg80211bssupdate() looks for an existing entry with the same BSSID and a hidden (zero-length or NUL-filled) SSID, and if it finds one it groups them, using the beacon IEs from the existing entry.
But that could find another entry without a beacon, if it was also from a probe response (with SSID), so there's a group without beacon elements.
If a beacon with a hidden SSID for that BSSID arrives later, cfg80211combinebsses() goes looking for the probe response entries that belong to it - i.e. entries with the same BSSID and channel that have no beacon IEs - and finds those two. They are already grouped with each other, so it hits its
WARNONONCE(bss->pub.hiddenbeaconbss) WARNONONCE(!listempty(&bss->hiddenlist))
which are there because an entry without beacon elements is not supposed to be part of a group yet.
Only combine entries when a beacon was already received, ones that are kept separate will be combined when a beacon arrives.
Affected Software
Event History
Frequently Asked Questions
What conditions are needed to trigger the warning?
The issue requires cfg80211 to receive probe responses for an unknown BSS with the same BSSID, including a hidden SSID entry, before a beacon with a hidden SSID for that BSSID arrives. The premature grouping of probe-response-only entries causes the later beacon processing to reach WARN_ON_ONCE conditions.
What is the operational impact described?
The described impact is kernel WARN_ON_ONCE warnings during hidden-BSS grouping. The provided information does not describe code execution, privilege escalation, information disclosure, or a denial-of-service outcome.
What changes in the resolved version?
The fix prevents cfg80211 from grouping hidden BSS entries unless the existing entry has beacon information. Probe-response-only entries remain separate until a beacon arrives, at which point they can be combined correctly.