CVE-2026-98421: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-98421 is a denial-of-service vulnerability in the Linux kernel's mac80211 Wi-Fi subsystem, specifically in the handling of TDLS (Tunneled Direct Link Setup) setup confirm frames. The flaw exists because the kernel does not validate that a peer station exists as a TDLS station before processing WLAN_TDLS_SETUP_CONFIRM frames, triggering a WARN_ON_ONCE(!sta || !ap_sta) kernel warning. It affects Linux kernel versions from 3.17 onward, with fixes backported to stable releases 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8, and 7.3-rc4. The CVSS base score is estimated as Medium (0.0 formally assigned at time of publication) (GitHub Advisory, EUVD).

The root cause is insufficient input validation (CWE-20) in the mac80211 TDLS management path: the kernel accepts WLAN_TDLS_SETUP_CONFIRM frames without first verifying that the referenced peer station exists as a registered TDLS station, leading to a null-pointer dereference warning (WARN_ON_ONCE). An attacker on the local wireless network can send a crafted TDLS setup confirm frame targeting a non-existent station, triggering the warning and potentially destabilizing the wireless subsystem. The fix requires that a peer station already exist as a TDLS station before the confirm frame is processed, and restructures the call to ieee80211_tdls_prep_mgmt_packet() to accommodate the existing WLAN_TDLS_DISCOVERY_REQUEST fall-through path (GitHub Advisory, Kernel Announce).

Successful exploitation can cause kernel warnings and destabilization of the wireless subsystem on affected Linux systems, resulting in a denial-of-service condition for Wi-Fi connectivity. The impact is limited to availability — there is no evidence of confidentiality or integrity compromise. The attack is constrained to the local network segment, limiting the blast radius to systems within wireless range of the attacker (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires local network (wireless) adjacency, limiting the attacker pool to those within Wi-Fi range of a vulnerable system (GitHub Advisory).

Update the Linux kernel to a patched stable release: 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8, or 7.3-rc4 and later. The patch enforces validation that a peer TDLS station exists before processing WLAN_TDLS_SETUP_CONFIRM frames. As a temporary workaround where upgrading is not immediately possible, disabling TDLS support on affected wireless interfaces (if not operationally required) can reduce exposure (GitHub Advisory, Kernel Announce).