HIGH Introduced in 5.4
cfg80211 BssEntry Panic
CVE-2026-98339
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.5MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't filter by BSS type when removing stale entries When an assoc AP switches to a channel that already has a BSS entry, cfg80211_update_assoc_bss_entry() removes that entry before rehashing the real one, since the two would otherwise collide in the BSS rbtree. The lookup for that entry also required it to match the connection's BSS type, so an entry advertising e.g. the IBSS capability bit was left in place, and the following cfg80211_rehash_bss() then ran into it: WARN_ON(!cmp) Changing the type shouldn't really happen, but can be triggered by a rogue AP/device, so drop the check and remove any entries matching the comparison.
02KernelScan AI Analysis
Risk summary
A rogue WiFi access point within radio range can trigger a kernel warning and potential panic on a victim device by advertising a mismatched BSS type during a channel switch. The stale entry left in the kernel's BSS search tree causes a tree integrity violation. No privileges on the victim device and no user interaction are required.
Vulnerability analysis
When a WiFi access point changes channels, the kernel updates its internal BSS tracking structures and must remove any stale duplicate entry from the BSS search tree before re-inserting the updated one. However, the cleanup code also required the stale entry to match the connection's BSS type, so an entry advertising a different network type (such as IBSS instead of infrastructure) was skipped and left in place. The leftover duplicate then caused a tree integrity violation that triggers a kernel warning, which can panic the kernel if warnings are configured as fatal. The fix removes the BSS type filter during cleanup so any matching entry is removed regardless of its advertised type. A rogue WiFi access point within radio range can trigger this by changing its advertised BSS type during a channel switch, requiring no privileges on the victim device and no user interaction.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 5.4 | 5.10.271 | 6ef87a853327 |
| 5.15 | 5.4 | 5.15.222 | 1380ee3a202d |
| 6.1 | 5.4 | 6.1.189 | fb445ec7480d |
| 6.6 | 5.4 | 6.6.158 | 65fdb973bd90 |
| 6.12 | 5.4 | 6.12.112 | 64e23a36d8f0 |
| 6.18 | 5.4 | 6.18.54 | 6d2fd2618567 |
| 7.2 | 5.4 | 7.2.8 | 0aa44982125c |
| mainline | 5.4 | 7.3-rc4 | b377e1000d96 |