UBUNTU-CVE-2026-98334: Medium severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reset state when starting AP fails ieee80211startap() can set enablebeacon (and beaconint) and fail later, leaving it set forever. Scanning can then attempt to restore beaconing on such an interface, leading to: Oops: divide error: 0000 [#1] SMP KASAN NOPTI RIP: 0010:mac80211hwsimlinkinfochanged+0xca7/0xf00 Call Trace: drvlinkinfochanged+0x413/0x860 net/mac80211/driver-ops.c:495 ieee80211linkinfochangenotify+0x24b/0x3c0 net/mac80211/main.c:427 ieee80211offchannelreturn+0x381/0x580 net/mac80211/offchannel.c:160 ieee80211scancompleted+0x993/0xe30 net/mac80211/scan.c:519 ieee80211scanwork+0x472/0x2010 net/mac80211/scan.c:1193 cfg80211wiphywork+0x2b7/0x550 net/wireless/core.c:538 in hwsim. Also, cfg80211 then allows changing the interface type, and the off-channel path getgs confused about beaconing as well, leading to another warning: WARNING: net/mac80211/driver-ops.c:468 at drvlinkinfochanged+0x583/0x880 ieee80211linkinfochangenotify+0x24b/0x3c0 net/mac80211/main.c:427 ieee80211offchannelstopvifs+0x328/0x5c0 net/mac80211/offchannel.c:122 ieee80211startswscan net/mac80211/scan.c:583 [inline] ieee80211startscan+0xfb6/0x1af0 net/mac80211/scan.c:882 Reset the state on failures to always have it correct.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Reset mac80211 AP state when ieee80211_start_ap() fails, ensuring enable_beacon and beacon_int are not left set after the failure.
Event History
Frequently Asked Questions
Which Ubuntu kernel package families are listed as affected?
The listed package families are ubuntu/linux, ubuntu/linux-fips, ubuntu/linux-aws, ubuntu/linux-azure, ubuntu/linux-aws-fips, ubuntu/linux-azure-fips, ubuntu/linux-gcp, and ubuntu/linux-gcp-fips.
What access and conditions are required for exploitation?
The vector is local and requires low privileges; no user interaction is required. The failure path involves an AP start operation that fails after beaconing state is set, followed by scanning or off-channel processing that attempts to restore or manage beaconing.
What is the primary security impact?
The supplied vector indicates high availability impact, with no confidentiality or integrity impact. The described result includes a kernel Oops caused by a divide error and additional kernel warnings.
How might an affected system present operationally?
Observed symptoms can include an Oops reporting a divide error in mac80211_hwsim_link_info_changed during scan completion or off-channel return processing. A warning at drv_link_info_changed may also occur when off-channel processing handles interfaces with confused beaconing state.