Is there a patch available for CVE-2026-98340?

Yes, a patch is available for CVE-2026-98340. Update the affected software to the latest version immediately.

Linux CVE-2026-98340

EUVD-2026-93325

2026-10-06 Linux

GHSA-84vw-9582-fhpx

Information Disclosure Linux

View

Monitor Track and reassess. Why: No CVSS yet + weak signal (CWE or non-zero EPSS).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisCVE.org

In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: only group hidden BSSes with beacon entries

When a probe response for an unknown BSS comes in, __cfg80211_bss_update() looks for an existing entry with the same BSSID and a hidden (zero-length or NUL-filled) SSID, and if it finds one it groups them, using the beacon IEs from the existing entry.

But that could find another entry without a beacon, if it was also from a probe response (with SSID), so there's a group without beacon elements.

If a beacon with a hidden SSID for that BSSID arrives later, cfg80211_combine_bsses() goes looking for the probe response entries that belong to it - i.e. entries with the same BSSID and channel that have no beacon IEs - and finds those two. They are already grouped with each other, so it hits its

WARN_ON_ONCE(bss->pub.hidden_beacon_bss) WARN_ON_ONCE(!list_empty(&bss->hidden_list))

which are there because an entry without beacon elements is not supposed to be part of a group yet.

Only combine entries when a beacon was already received, ones that are kept separate will be combined when a beacon arrives.

Affected VersionsENISA

Linux 4593c4cbe1c96b3995727dc42f6aa103f4ff5afc <4cd6a518ce7527284bbc9baab5fa2453a7d477c2

Linux patch: 6.6.158

Linux patch: 5.10.271

Linux 4593c4cbe1c96b3995727dc42f6aa103f4ff5afc <74ed0d992f392c75e1969415527e06df3f7a4034

Linux 4593c4cbe1c96b3995727dc42f6aa103f4ff5afc <068843ed0902c552a13860c5ec6b2ca65b57a065

Linux patch: 5.15.222

Linux 4593c4cbe1c96b3995727dc42f6aa103f4ff5afc <7405dd19bda4537a2843637d8d7bed1efd4776cf

Linux 4593c4cbe1c96b3995727dc42f6aa103f4ff5afc <3658093df69849daf4f813a8f087f358e13be203

Linux patch: 7.3-rc4

Linux 4593c4cbe1c96b3995727dc42f6aa103f4ff5afc <332ea1502c46f53375cb109fa82bfaff818f3a41

Linux patch: 0

Linux patch: 7.2.8

Linux 4593c4cbe1c96b3995727dc42f6aa103f4ff5afc <73365b81630b57e1a1f9d50dc87281797855c2ac

Linux patch: 6.12.112

Linux 4593c4cbe1c96b3995727dc42f6aa103f4ff5afc <86235be788094131912e9bd8412b358d91d99f49

Linux patch: 6.1.189

Linux patch: 6.18.54

Linux 3.9

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Lifecycle Timeline

Patch available

Oct 06, 2026 - 10:02 EUVD

CVE Published

Oct 06, 2026 - 08:46 cve.org

UNKNOWN (no severity yet)

Threat Intelligence Overview

EPSS Score

0.2%

Top 93% exploitable

Threat Intel

1 sources

Data Quality

3 sources

Confidence: Low

EUVD

CVE.org

EPSS NEWS MSRC

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity Not scored yet

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

No CVSS yet + weak signal (CWE or non-zero EPSS)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.