Is there a patch available for EUVD-2026-101055?

Yes, a patch is available for EUVD-2026-101055. Update the affected software to the latest version immediately.

Linux EUVD-2026-101055

| CVE-2026-98406

2026-10-14 Linux

GHSA-9hw7-47p3-c6fj

Information Disclosure Linux

View

Monitor Track and reassess. Why: No CVSS yet + weak signal (CWE or non-zero EPSS).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisCVE.org

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver

ieee80211_set_bitrate_mask() checks if the interface is running via ieee80211_sdata_running(), but it does not check if the interface is still present in the driver.

When sdata is running but IEEE80211_SDATA_IN_DRIVER is not set, the call reaches drv_set_bitrate_mask() in driver-ops.h which hits

wlan1: Failed check-sdata-in-driver check, flags: 0x0 WARNING: net/mac80211/driver-ops.h:884 at drv_set_bitrate_mask

Syzkaller triggers this via wext SIOCSIWRATE ioctl. The Call Trace shows wext_ioctl_dispatch() in wext-core.c dispatching the ioctl, calling ioctl_standard_call() for SIOCSIWRATE, which calls cfg80211_wext_siwrate() in wext-compat.c. That builds a bitrate mask and calls rdev_set_bitrate_mask() which ends up in ieee80211_set_bitrate_mask() in cfg.c. The interface is marked running via SDATA_STATE_RUNNING but flags is 0, so check_sdata_in_driver() fails.

When the interface is being torn down, or when wext ioctl is issued during interface bringup before drv_add_interface() sets IN_DRIVER, the running check passes while IN_DRIVER is clear.

Check IEEE80211_SDATA_IN_DRIVER in ieee80211_set_bitrate_mask() before calling the driver, returning -ENETDOWN. This avoids the WARN_ONCE in driver-ops.h and matches other cfg.c operations that bail early when not in driver.

This change should be safe because wiphy mutex is held in cfg80211_wext_siwrate() via guard(wiphy), and IN_DRIVER is set/cleared under RTNL and wiphy paths in drv_add_interface() and drv_remove_interface() in driver-ops.c, so the check is race-free against driver add/remove. Returning -ENETDOWN is the same error other not-running paths use and does not introduce new locking.

[also add second syzbot report]

Affected VersionsENISA

Linux patch: 6.6.158

Linux 554a43d5e77e8256aa9685ffd19ad555e6f77979 <4ba86c44b2fcb1c3175caa2456b6d58f483446ab

Linux 554a43d5e77e8256aa9685ffd19ad555e6f77979 <c2cd9c44777cf97be3e35c10b7c2d8f59ebb9306

Linux 554a43d5e77e8256aa9685ffd19ad555e6f77979 <432c8532d5ccc2af77da43ed6ef1c80495a4efe8

Linux 554a43d5e77e8256aa9685ffd19ad555e6f77979 <c4ee5685af444024e6222ce29f6ed36adc44ffc3

Linux patch: 0

Linux 554a43d5e77e8256aa9685ffd19ad555e6f77979 <4095b66acae9893dd13deb39a4331651cb2f822b

Linux patch: 7.3-rc4

Linux 3.5

Linux patch: 6.1.189

Linux patch: 6.18.54

Linux patch: 6.12.112

Linux 554a43d5e77e8256aa9685ffd19ad555e6f77979 <7978dda63d2b109ea9c3f7a096cd1aac6542cd54

Linux 554a43d5e77e8256aa9685ffd19ad555e6f77979 <da2ca406f45a6e21760243152ed8d2e8e72915c2

Linux patch: 7.2.8

Linux patch: 5.10.271

Linux 554a43d5e77e8256aa9685ffd19ad555e6f77979 <0d1700394e9f5d0bd9bebad8d5a50edf983f52fd

Linux patch: 5.15.222

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Lifecycle Timeline

Patch available

Oct 14, 2026 - 15:03 EUVD

CVE Published

Oct 14, 2026 - 13:27 cve.org

UNKNOWN (no severity yet)

Threat Intelligence Overview

EPSS Score

0.2%

Top 88% exploitable

Data Quality

3 sources

Confidence: Low

EUVD

CVE.org

EPSS MSRC

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity Not scored yet

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

No CVSS yet + weak signal (CWE or non-zero EPSS)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.