UBUNTU-CVE-2026-98338: Low severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: ibss: ref BSS entry for joined event When the IBSS is joined, we only record the BSSID/channel in the event and look up the BSS entry when processing it. However, that's racy, e.g. a new scan with NL80211SCANFLAGFLUSH can remove it, causing a warning in the event work: !bss WARNING: net/wireless/ibss.c:37 at cfg80211ibssjoined+0x3d3/0x440 Workqueue: cfg80211 cfg80211eventwork cfg80211processwdevevents+0x39f/0x5b0 net/wireless/util.c:1144 cfg80211processrdevevents+0xa1/0x110 net/wireless/util.c:1179 cfg80211eventwork+0x2f/0x40 net/wireless/core.c:393 Do the lookup early (the driver is expected to only join an IBSS that has a BSS entry) and keep a reference to it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Ubuntu systems using the listed Linux kernel packages are affected when they use cfg80211 IBSS (ad-hoc Wi-Fi) join handling. The affected package set includes linux, linux-fips, and the AWS, Azure, and GCP kernel variants, including their FIPS variants.
What conditions are needed to trigger the warning?
An IBSS join must be in progress, and a scan using NL80211_SCAN_FLAG_FLUSH must remove the corresponding BSS entry before the queued join event is processed. This is a race condition in cfg80211 event handling.
What is the observed impact?
The described result is a kernel warning when the IBSS joined-event worker cannot find the BSS entry. The supplied severity data indicates low availability impact and no reported confidentiality or integrity impact.
How can administrators identify relevant events?
Look for kernel warnings from __cfg80211_ibss_joined in net/wireless/ibss.c, particularly messages containing "!bss" and cfg80211_event_work in the workqueue stack trace.