CVE-2026-98702: wifi: mac80211: reject invalid 320 MHz CSA bandwidth
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: reject invalid 320 MHz CSA bandwidth
The HT/VHT channel definition validator can receive a 320 MHz bandwidth indication from a received CSA frame on a non-6 GHz link. It warns for this unsupported width but continues with an uninitialized vhtoperation.chanwidth, which is then read by ieee80211chandefvhtoper(). With paniconwarn enabled, this lets a received frame panic the kernel.
Reject the channel definition before entering the VHT operation conversion. This preserves the existing CSA fallback while avoiding both the warning and the uninitialized read.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Linux systems using mac80211 Wi-Fi on a non-6 GHz link are exposed when they process a received Channel Switch Announcement (CSA) frame that indicates 320 MHz bandwidth. The provided information specifically identifies a kernel panic impact when panic_on_warn is enabled.
What does an attacker need to do to trigger the problem?
An attacker needs to cause the affected system to receive a CSA frame containing an invalid 320 MHz bandwidth indication on a non-6 GHz link. The issue is triggered during channel-definition validation and VHT operation conversion.
What is the impact if panic_on_warn is enabled?
The invalid received frame can produce a kernel warning, and panic_on_warn turns that warning into a kernel panic. This creates a denial-of-service condition.
What changes in the fix?
The fix rejects the invalid channel definition before VHT operation conversion. It prevents both the warning and the read of the uninitialized vht_operation.chan_width value while retaining the existing CSA fallback behavior.