CVE-2026-98702

Status: ReceivedUnscored—

Severity—Unscored

Exploitation probability0.17 %higher than 6% of CVEs

Active exploitationNonot in the CISA catalog

Public exploitNot knownno public code found

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: reject invalid 320 MHz CSA bandwidth

The HT/VHT channel definition validator can receive a 320 MHz bandwidth indication from a received CSA frame on a non-6 GHz link. It warns for this unsupported width but continues with an uninitialized vht_operation.chan_width, which is then read by ieee80211_chandef_vht_oper(). With panic_on_warn enabled, this lets a received frame panic the kernel.

Reject the channel definition before entering the VHT operation conversion. This preserves the existing CSA fallback while avoiding both the warning and the uninitialized read.

CVSS

NVD hasn't assigned a CVSS score to this CVE (common since the April 2026 policy change).

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.17 %
Percentile among all scored CVEs: 6
Score date: 10/20/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Linux — Linux Kernel^AI

References

Show 4 references

Raw JSON (NVD)

Show

{
  "id": "CVE-2026-98702",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "21c3f8f95554feff9bed15703e89adbe582e0383",
              "lessThan": "cf0ddacce173890407ed3fa50c8ea9b3c0cc0e16",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "21c3f8f95554feff9bed15703e89adbe582e0383",
              "lessThan": "1892e71aa2e5ee667d87c6e49e3661f5e290303b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "21c3f8f95554feff9bed15703e89adbe582e0383",
              "lessThan": "79b3ce0d881cd6e5d4d3496b19f5cc5e7089a56c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "21c3f8f95554feff9bed15703e89adbe582e0383",
              "lessThan": "56e236759f0a8dc910c2ae7cd3c161f298ee5794",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "net/mac80211/spectmgmt.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.9",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.12.113",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.56",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.10",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/mac80211/spectmgmt.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-10-18T16:17:23.700",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/1892e71aa2e5ee667d87c6e49e3661f5e290303b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/56e236759f0a8dc910c2ae7cd3c161f298ee5794",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/79b3ce0d881cd6e5d4d3496b19f5cc5e7089a56c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/cf0ddacce173890407ed3fa50c8ea9b3c0cc0e16",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: reject invalid 320 MHz CSA bandwidth\n\nThe HT/VHT channel definition validator can receive a 320 MHz\nbandwidth indication from a received CSA frame on a non-6 GHz link.\nIt warns for this unsupported width but continues with an uninitialized\nvht_operation.chan_width, which is then read by\nieee80211_chandef_vht_oper(). With panic_on_warn enabled, this lets a\nreceived frame panic the kernel.\n\nReject the channel definition before entering the VHT operation\nconversion. This preserves the existing CSA fallback while avoiding\nboth the warning and the uninitialized read."
    }
  ],
  "lastModified": "2026-10-19T10:19:34.500",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}