CVE-2026-98421: wifi: mac80211: require a peer station for TDLS setup confirm
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: require a peer station for TDLS setup confirm
It's nonsense for the setup confirm to go to station that doesn't even exist, and it hits a warning when building the frame:
WARNONONCE(!sta || !apsta)
Only accept WLANTDLSSETUPCONFIRM when the station is already there as a TDLS station. Need to copy the call to ieee80211tdlsprepmgmtpacket() since the existing WLANTDLSDISCOVERYREQUEST already falls through to it.
Affected Software
Event History
Frequently Asked Questions
What configurations are exposed to this issue?
The affected code path handles WLAN_TDLS_SETUP_CONFIRM frames in the Linux kernel mac80211 Wi-Fi stack. Systems are relevant where TDLS setup-confirm processing can occur.
What condition triggers the warning described in the fix?
The warning is reached when a TDLS setup confirm is processed for a peer station that does not exist as a TDLS station. The corrected behavior accepts WLAN_TDLS_SETUP_CONFIRM only when that station is already present as a TDLS station.
How can an affected system be identified?
Kernel logs may contain the WARN_ON_ONCE condition associated with a missing station or AP station while building a TDLS management frame. The condition shown is !sta or !ap_sta.