CVE-2026-98703: wifi: mac80211: minstrel_ht: validate fixed rate index
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: minstrelht: validate fixed rate index
The fixedrateidx debugfs file is a plain u32 attribute, so any value can be written to it. minstrelhtupdatestats() then copies the value into mi->maxtprate[] and mi->maxprobrate, and minstrelhtsetrate() uses MIRATEGROUP()/MIRATEIDX() to index minstrelmcsgroups[] (42 entries) and mi->groups[].rates[] (10 entries) with it.
Writing e.g. 65535 selects group 4095 and rate index 15, far outside both arrays. The out-of-bounds entries are dereferenced and updated as struct minstrelratestats (retry counts, etc.), so the invalid index corrupts adjacent kernel memory. With CONFIGUBSANBOUNDS the access is reported as an array-index-out-of-bounds in minstrelhtsetrate().
Only a valid group/rate pair, or U32MAX to disable fixed rate processing, can be used safely, so reject any other value when the debugfs file is written.
The file is only reachable through a root-only debugfs mount, so this is not a privilege boundary. The out-of-bounds access is still a bug that must not be reachable through a writable debugfs attribute.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
azurelinux/kernelto a version that resolves this vulnerability.Fixed in 6.6.161.1-1 - Configuration
Reject any other value when the fixed_rate_idx debugfs file is written; use U32_MAX to disable fixed-rate processing.
Linux kernel mac80211 minstrel_ht fixed_rate_idx = Only a valid group/rate pair or U32_MAX
Event History
Frequently Asked Questions
Who can trigger this issue in practice?
Only a user able to write the root-only debugfs fixed_rate_idx file can trigger it. The affected interface is not a privilege boundary, so unprivileged users cannot reach it unless they already have equivalent privileged access.
What input causes the memory corruption?
Writing a fixed-rate value that is neither a valid group/rate pair nor U32_MAX can cause out-of-bounds indexing into minstrel rate arrays. For example, 65535 selects an invalid group and rate index, leading to adjacent kernel memory corruption when rate statistics are updated.
What can be done if the fix cannot be applied immediately?
Do not write arbitrary values to the fixed_rate_idx debugfs attribute. Restrict access to the root-only debugfs mount and use only valid group/rate values or U32_MAX, which disables fixed-rate processing.
How might the issue be detected during testing?
Kernels built with CONFIG_UBSAN_BOUNDS report the condition as an array-index-out-of-bounds in minstrel_ht_set_rate(). This can be triggered by writing an invalid fixed_rate_idx value through the debugfs interface.