{"id":"CVE-2026-98340","revision":"00ee939c452045cda56c826e12931de3","records":[{"revision":"00ee939c452045cda56c826e12931de3","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98340","aliases":[],"title":"wifi: cfg80211: only group hidden BSSes with beacon entries","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: only group hidden BSSes with beacon entries\n\nWhen a probe response for an unknown BSS comes in, __cfg80211_bss_update()\nlooks for an existing entry with the same BSSID and a hidden (zero-length\nor NUL-filled) SSID, and if it finds one it groups them, using the beacon\nIEs from the existing entry.\n\nBut that could find another entry without a beacon, if it was also from a\nprobe response (with SSID), so there's a group without beacon elements.\n\nIf a beacon with a hidden SSID for that BSSID arrives later,\ncfg80211_combine_bsses() goes looking for the probe response entries that\nbelong to it - i.e. entries with the same BSSID and channel that have no\nbeacon IEs - and finds those two. They are already grouped with each\nother, so it hits its\n\n  WARN_ON_ONCE(bss->pub.hidden_beacon_bss)\n  WARN_ON_ONCE(!list_empty(&bss->hidden_list))\n\nwhich are there because an entry without beacon elements is not supposed\nto be part of a group yet.\n\nOnly combine entries when a beacon was already received, ones that are\nkept separate will be combined when a beacon arrives.","state":0,"publishedAt":"2026-10-06T08:46:30.796+00:00","modifiedAt":"2026-10-19T09:17:51.387+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/wireless/scan.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4593c4cbe1c96b3995727dc42f6aa103f4ff5afc\",\n                            \"lessThan\": \"4cd6a518ce7527284bbc9baab5fa2453a7d477c2\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4593c4cbe1c96b3995727dc42f6aa103f4ff5afc\",\n                            \"lessThan\": \"74ed0d992f392c75e1969415527e06df3f7a4034\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4593c4cbe1c96b3995727dc42f6aa103f4ff5afc\",\n                            \"lessThan\": \"3658093df69849daf4f813a8f087f358e13be203\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4593c4cbe1c96b3995727dc42f6aa103f4ff5afc\",\n                            \"lessThan\": \"73365b81630b57e1a1f9d50dc87281797855c2ac\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4593c4cbe1c96b3995727dc42f6aa103f4ff5afc\",\n                            \"lessThan\": \"7405dd19bda4537a2843637d8d7bed1efd4776cf\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4593c4cbe1c96b3995727dc42f6aa103f4ff5afc\",\n                            \"lessThan\": \"86235be788094131912e9bd8412b358d91d99f49\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4593c4cbe1c96b3995727dc42f6aa103f4ff5afc\",\n                            \"lessThan\": \"332ea1502c46f53375cb109fa82bfaff818f3a41\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"4593c4cbe1c96b3995727dc42f6aa103f4ff5afc\",\n                            \"lessThan\": \"068843ed0902c552a13860c5ec6b2ca65b57a065\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/wireless/scan.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3.9\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.9\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.271\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.222\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.189\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.158\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.112\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.54\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.8\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/4cd6a518ce7527284bbc9baab5fa2453a7d477c2","https://git.kernel.org/stable/c/74ed0d992f392c75e1969415527e06df3f7a4034","https://git.kernel.org/stable/c/3658093df69849daf4f813a8f087f358e13be203","https://git.kernel.org/stable/c/73365b81630b57e1a1f9d50dc87281797855c2ac","https://git.kernel.org/stable/c/7405dd19bda4537a2843637d8d7bed1efd4776cf","https://git.kernel.org/stable/c/86235be788094131912e9bd8412b358d91d99f49","https://git.kernel.org/stable/c/332ea1502c46f53375cb109fa82bfaff818f3a41","https://git.kernel.org/stable/c/068843ed0902c552a13860c5ec6b2ca65b57a065"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98340","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98340","identifiers":["CVE-2026-98340"]},"retained":false,"historicalAffected":[]}],"coverage":[]}