CVE-2026-98425: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-98425 is a low-severity vulnerability in the Linux kernel's mac80211 Wi-Fi subsystem, specifically in the ieee80211_request_ibss_scan() function. The issue causes an unnecessary kernel warning (WARN) when a regulatory domain change leaves no allowed channels for an IBSS (Independent Basic Service Set / ad-hoc Wi-Fi) network to scan, which is a valid and expected condition during the 60-second grace period before IBSS shutdown. Affected Linux kernel versions include 3.4.26–3.5 and 3.7.3–3.8, as well as specific git commit ranges starting from 34bcf71502413f8903ade93746f2d0f04b937a78. The CVSS base score is reported as 0.0, and Feedly estimates severity as Medium (GitHub Advisory, ENISA EUVD).

The root cause is an overly strict assertion (warning) in ieee80211_request_ibss_scan() within the Linux kernel's mac80211 layer. When the regulatory domain changes while an IBSS network is active, it is possible for no channels to remain permitted for scanning; this is a legitimate transient state, not an error condition. The fix simply removes the spurious WARN call in this code path, preventing unnecessary kernel log noise or potential system instability from repeated warnings. No CWE classification has been formally assigned to this vulnerability (GitHub Advisory).

The practical impact of this vulnerability is limited. The spurious warning does not directly enable code execution, privilege escalation, or data exfiltration; however, repeated kernel warnings in production environments can contribute to log noise, complicate incident response, and in edge cases may affect system stability or trigger watchdog mechanisms. The issue is confined to systems using IBSS (ad-hoc) Wi-Fi mode with dynamic regulatory domain changes (GitHub Advisory).

There is no known exploitation of CVE-2026-98425 in the wild, no public proof-of-concept exploit, and no entry in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.0, reflecting negligible exploitation probability. The vulnerability requires a specific combination of IBSS mode operation and a regulatory domain change, making opportunistic exploitation highly unlikely (GitHub Advisory).

Patches have been applied to multiple stable Linux kernel branches. Fixed commits include bb91c15953705445778c170a2523f12351c4d928, 5f139e17f5bdba6b68177dd8afe13fa4549dfc5f, 23d51c0bc18f21d957756ba4650520bb3bc726b2, and a7491b7efbd9136b120a12ed72af9c12121dd134. Unaffected (patched) versions include Linux 6.12.112+, 6.18.54+, 7.2.8+, and 7.3-rc4+. Administrators should update to a patched kernel version; no configuration-based workaround is documented, but disabling IBSS/ad-hoc Wi-Fi mode would eliminate exposure (GitHub Advisory).