CVE-2026-98698: wifi: mac80211: handle empty FILS association request payload
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: handle empty FILS association request payload
filsencryptassocreq() accepts a (Re)Association Request frame whose last element is the FILS Session element. cryptlen is then zero and aessivencrypt() is called with an empty plaintext.
kmemdup() returns ZEROSIZEPTR for a zero-length allocation, so the unconditional sginitone() puts an invalid page into the scatterlist. With CONFIGDEBUGSG this triggers a kernel BUG in sgsetbuf(); without the debug check the bogus page is handed to the crypto backend.
AES-SIV is defined for empty plaintext and the S2V result is then the complete output, so handle this case before the CTR step, which has nothing to encrypt.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
azurelinux/kernelto a version that resolves this vulnerability.Fixed in 6.6.161.1-1
Event History
Frequently Asked Questions
What conditions are required to trigger the issue?
An attacker must be able to supply a FILS (Re)Association Request frame whose FILS Session element is the final element, leaving the encrypted payload length at zero. The vulnerable path is reached when mac80211 processes that request and calls AES-SIV encryption.
What is the likely impact on systems with scatterlist debugging enabled?
With CONFIG_DEBUG_SG enabled, processing the crafted frame triggers a kernel BUG in sg_set_buf() because a zero-size allocation yields ZERO_SIZE_PTR, which is used to initialize a scatterlist entry. This can cause a kernel crash.
What happens when CONFIG_DEBUG_SG is not enabled?
The invalid scatterlist page is passed to the crypto backend instead of being stopped by the debug check. The provided information does not specify the resulting behavior or impact in that configuration.
How can the issue be mitigated if an update cannot be applied immediately?
The provided information identifies the triggering input as a FILS (Re)Association Request with an empty encrypted payload, but does not provide a configuration-level mitigation. Restricting exposure to untrusted wireless association traffic may reduce the opportunity to supply the crafted frame.