# CVE-2026-98406: wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver CVE-2026-98406 is fixed in 31 products on 1 platform, first by DEBIAN-CVE-2026-98406, released October 16, 2026. It is not reported as exploited. Patch Radar priority: Routine. - Web page: https://patchblox.com/security/cve/CVE-2026-98406 - Priority: Routine - CVSS: 2.5 (Low) - EPSS: 0.0022 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Oct 14, 2026 - Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-98406 ## Description In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver ieee80211_set_bitrate_mask() checks if the interface is running via ieee80211_sdata_running(), but it does not check if the interface is still present in the driver. When sdata is running but IEEE80211_SDATA_IN_DRIVER is not set, the call reaches drv_set_bitrate_mask() in driver-ops.h which hits wlan1: Failed check-sdata-in-driver check, flags: 0x0 WARNING: net/mac80211/driver-ops.h:884 at drv_set_bitrate_mask Syzkaller triggers this via wext SIOCSIWRATE ioctl. The Call Trace shows wext_ioctl_dispatch() in wext-core.c dispatching the ioctl, calling ioctl_standard_call() for SIOCSIWRATE, which calls cfg80211_wext_siwrate() in wext-compat.c. That builds a bitrate mask and calls rdev_set_bitrate_mask() which ends up in ieee80211_set_bitrate_mask() in cfg.c. The interface is marked running via SDATA_STATE_RUNNING but flags is 0, so check_sdata_in_driver() fails. When the interface is being torn down, or when wext ioctl is issued during interface bringup before drv_add_interface() sets IN_DRIVER, the running check passes while IN_DRIVER is clear. Check IEEE80211_SDATA_IN_DRIVER in ieee80211_set_bitrate_mask() before calling the driver, returning -ENETDOWN. This avoids the WARN_ONCE in driver-ops.h and matches other cfg.c operations that bail early when not in driver. This change should be safe because wiphy mutex is held in cfg80211_wext_siwrate() via guard(wiphy), and IN_DRIVER is set/cleared under RTNL and wiphy paths in drv_add_interface() and drv_remove_interface() in driver-ops.c, so the check is race-free against driver add/remove. Returning -ENETDOWN is the same error other not-running paths use and does not introduce new locking. [also add second syzbot report] ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | bpftool ol 8 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 | | Linux | bpftool ol 9 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 | | Linux | kernel-64kb sles 15.7 | 6.4.0-150700.53.90.1 | [SUSE-SU-2026:5091-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-5091-1.md) | Nov 7, 2026 | | Linux | kernel-azure sles 15.7 | 6.4.0-150700.53.90.1 | [SUSE-SU-2026:5091-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-5091-1.md) | Nov 7, 2026 | | Linux | kernel-default sles 15.7 | 6.4.0-150700.53.90.1 | [SUSE-SU-2026:5091-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-5091-1.md) | Nov 7, 2026 | | Linux | kernel-default-base sles 15.7 | 6.4.0-150700.53.90.1.150700.17.51.1 | [SUSE-SU-2026:5091-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-5091-1.md) | Nov 7, 2026 | | Linux | kernel-docs sles 15.7 | 6.4.0-150700.53.90.1 | [SUSE-SU-2026:5091-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-5091-1.md) | Nov 7, 2026 | | Linux | kernel-livepatch-SLE15-SP7_Update_24 sles 15.7 | 1-150700.15.3.1 | [SUSE-SU-2026:5091-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-5091-1.md) | Nov 7, 2026 | | Linux | kernel-obs-build sles 15.7 | 6.4.0-150700.53.90.1 | [SUSE-SU-2026:5091-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-5091-1.md) | Nov 7, 2026 | | Linux | kernel-source sles 15.7 | 6.4.0-150700.53.90.1 | [SUSE-SU-2026:5091-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-5091-1.md) | Nov 7, 2026 | | Linux | kernel-syms sles 15.7 | 6.4.0-150700.53.90.1 | [SUSE-SU-2026:5091-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-5091-1.md) | Nov 7, 2026 | | Linux | kernel-uek ol 8 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 | | Linux | kernel-uek ol 9 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 | | Linux | kernel-uek-container ol 8 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 | | Linux | kernel-uek-container ol 9 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 | | Linux | kernel-uek-container-debug ol 8 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 | | Linux | kernel-uek-container-debug ol 9 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 | | Linux | kernel-uek-core ol 8 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 | | Linux | kernel-uek-core ol 9 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 | | Linux | kernel-uek-debug ol 8 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 | | Linux | kernel-uek-debug ol 9 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 | | Linux | kernel-uek-debug-core ol 8 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 | | Linux | kernel-uek-debug-core ol 9 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 | | Linux | kernel-uek-debug-devel ol 8 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 | | Linux | kernel-uek-debug-devel ol 9 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 | | Linux | kernel-uek-debug-modules ol 8 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 | | Linux | kernel-uek-debug-modules ol 9 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 | | Linux | kernel-uek-debug-modules-extra ol 8 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 | | Linux | kernel-uek-debug-modules-extra ol 9 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 | | Linux | kernel-uek-devel ol 8 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 | | Linux | kernel-uek-devel ol 9 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 | | Linux | kernel-uek-doc ol 8 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 | | Linux | kernel-uek-doc ol 9 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 | | Linux | kernel-uek-modules ol 8 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 | | Linux | kernel-uek-modules ol 9 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 | | Linux | kernel-uek-modules-extra ol 8 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 | | Linux | kernel-uek-modules-extra ol 9 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 | | Linux | kernel-uek64k ol 8 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 | | Linux | kernel-uek64k ol 9 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 | | Linux | kernel-uek64k-core ol 8 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 | | Linux | kernel-uek64k-core ol 9 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 | | Linux | kernel-uek64k-devel ol 8 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 | | Linux | kernel-uek64k-devel ol 9 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 | | Linux | kernel-uek64k-modules ol 8 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 | | Linux | kernel-uek64k-modules ol 9 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 | | Linux | kernel-uek64k-modules-extra ol 8 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 | | Linux | kernel-uek64k-modules-extra ol 9 | 0:5.15.0-326.222.4.el9uek | [ELSA-2026-500574](https://patchblox.com/security/data/fix/linux/elsa-2026-500574.md) | Nov 7, 2026 | | Linux | kernel-zfcpdump sles 15.7 | 6.4.0-150700.53.90.1 | [SUSE-SU-2026:5091-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-5091-1.md) | Nov 7, 2026 | | Linux | linux Debian 12.15 (bookworm) | 6.1.190-1 | [DEBIAN-CVE-2026-98406](https://patchblox.com/security/data/fix/linux/debian-cve-2026-98406.md) | Oct 16, 2026 | | Linux | linux Debian 13.5 (trixie) | 6.12.113-1 | [DEBIAN-CVE-2026-98406](https://patchblox.com/security/data/fix/linux/debian-cve-2026-98406.md) | Oct 16, 2026 | | Linux | linux Debian 14 | 7.2.8-1 | [DEBIAN-CVE-2026-98406](https://patchblox.com/security/data/fix/linux/debian-cve-2026-98406.md) | Oct 16, 2026 | | Linux | linux-6.12 Debian 12.15 (bookworm) | 6.12.113-1~deb12u1 | [DEBIAN-CVE-2026-98406](https://patchblox.com/security/data/fix/linux/debian-cve-2026-98406.md) | Oct 16, 2026 | --- Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.