CVE-2026-98337

Executive Summary

CVE-2026-98337 is a concurrency flaw in the Linux kernel's mac80211 subsystem, specifically a race condition in the Remain-on-Channel (ROC) handling that can be triggered when a ROC work item is pending and a scan begins before the ROC work is processed. A subsequent ROC added to the list is then picked up during scan operations, causing a kernel warning and a Workqueue trace in ieee80211_start_next_roc. Systems running affected Linux kernels with Wi-Fi drivers using mac80211 are impacted; the immediate effect is a kernel warning and potential denial-of-service via unstable wireless operation.

Technical Analysis

The vulnerability resides in the mac80211 off-channel management logic. The NVD description states that "the ROC work can be pending when a scan starts (which requires ROC list to be empty, but that's possible), and then a new ROC can be added to the list and the work will pick it up." The core problem is that the ROC work scheduled earlier is not synchronized against the scan state, so when the scan transitions through completion, __ieee80211_scan_completed (in net/mac80211/scan.c:537) can be reached while a ROC is active. The trace shows ieee80211_start_next_roc+0x256/0x2d0 hitting a warning at net/mac80211/offchannel.c:404, triggered from ieee80211_scan_work (scan.c:1193) via cfg80211_wiphy_work (net/wireless/core.c:513). This indicates a state-machine inconsistency inside mac80211's offchannel scan/ROC coordination.

The attack surface is the local Wi-Fi configuration path. An attacker (or a misbehaving userspace component) able to enqueue a ROC request while a scan is starting can drive the kernel into the warned state. Because mac80211 is a softMAC layer, this is reachable through nl80211 operations on wiphy devices, though the description does not name a specific netlink command or parameter; only the internal call chain is specified. The mechanism is a classic TOCTOU/race (CWE-362) between the ROC workqueue item and the scan work item, both running on the events_unbound workqueue system. No memory-safety primitive (arbitrary read/write, UAF) is claimed in the description.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class (concurrency race in kernel workqueue scheduling). The following describes the attack at the vulnerability-class level:

1. Reconnaissance / target identification: An attacker identifies a host using a Linux kernel with the mac80211 Wi-Fi stack where a wireless interface is present and can be configured (local user, or a process with CAP_NET_ADMIN on the wireless phy). This aligns with local-access scenarios on Wi-Fi-enabled laptops, access points, and SBCs.

2. Triggering the flaw class: The attacker causes a scan to begin (e.g., a normal Wi-Fi scan) while a ROC work item is already pending, then queues an additional ROC request. Because the ROC work and scan work are not mutually excluded, the newly added ROC is picked up during the scan transition, violating the expected "ROC list empty during scan" invariant.

3. Execution method (vulnerability-class level): This is a race-condition trigger, not a payload delivery. The "execution" is the timing of the concurrent nl80211/scan and ROC operations. No specific payload or memory-corruption primitive is described in the advisory.

4. Post-exploitation impact: The visible result is a kernel warning/trace at ieee80211_start_next_roc+0x256/0x2d0 and a broken ROC/offchannel state. The practical impact is denial of service — degraded or unstable Wi-Fi on the affected device, potential driver/workqueue stalls, and loss of off-channel operations (e.g., remain-on-channel for management frames, P2P, or off-channel TX). No privilege escalation is described.

Impact Assessment

CVSS Score is N/A in the provided data; the vector above is an inferred local/high-complexity availability-impact profile (AV:L, AC:H, PR:L, S:U, C:N, I:N, A:H) and should be treated as a best-effort representation, not an authoritative score. Business impact is availability-centric: affected endpoints include Linux-based Wi-Fi clients, wireless access points, and embedded networking devices running vulnerable kernels. Because the issue is in the wireless stack, blast radius is limited to devices actively using mac80211-managed Wi-Fi and to actors with the ability to issue scan/ROC operations. CISA KEV status is NO, there is no known exploit code, and EPSS is not yet scored by FIRST.org. No confidentiality or integrity impact is described.

Detection Guidance

Sigma Rule

title: Linux Kernel mac80211 ROC-While-Scanning Race Indicator
id: 8f3b9c2e-1a44-4d7e-9c21-0f6a2b7d5e01
status: experimental
description: Detects kernel log warning in ieee80211_start_next_roc consistent with CVE-2026-98337
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-98337
author: Threat Intelligence
date: 2026-01-01
logsource:
  product: linux
  service: kernel
detection:
  keywords:
    - 'ieee80211_start_next_roc'
    - 'offchannel.c:404'
    - '__ieee80211_scan_completed'
    - 'cfg80211_wiphy_work'
  condition: keywords
falsepositives:
  - Other mac80211 race conditions producing the same warning location
level: medium
tags:
  - attack.t1499

YARA Rule

rule CVE_2026_98337_mac80211_roc_scan_race
{
    meta:
        description = "Detects kernel log fragments referencing the mac80211 ROC/scan race warning"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-98337"
        author = "Threat Intelligence"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $w1 = "ieee80211_start_next_roc" ascii wide
        $w2 = "offchannel.c:404" ascii wide
        $w3 = "__ieee80211_scan_completed" ascii wide
        $w4 = "cfg80211_wiphy_work" ascii wide
        $w5 = "net/mac80211/offchannel.c" ascii wide

    condition:
        (uint32(0) == 0x464C457F) and (2 of ($w*))
}

Suricata IDS Rule

alert ip any any -> any any (msg:"CVE-2026-98337 mac80211 ROC/scan race - no network signature available"; flow:stateless; threshold: type limit, track by_src, count 1, seconds 60; sid:202698337; rev:1; metadata: cve CVE-2026-98337, affected_product Linux_Kernel, attack_target Client_Endpoint, deployment Perimeter, signature_severity Informational; classtype:attempted-dos;)

Note: CVE-2026-98337 is a local kernel concurrency issue in mac80211. There is no wire protocol artifact described; the rule above is a placeholder for inventory/telemetry correlation and should not be relied upon as a wire-level detector.

Elastic Detection

process where event.action == "start" and process.name == "wpa_supplicant"

Correlate with kernel log events containing host.os.type == "linux" and message like "ieee80211_start_next_roc" or "offchannel.c:404" to surface hosts exhibiting the warning condition; no endpoint EQL can directly see the race, so detection is log-driven.

Splunk SPL Query

index=os sourcetype=syslog OR sourcetype=kernel
("ieee80211_start_next_roc" OR "offchannel.c:404" OR "__ieee80211_scan_completed" OR "cfg80211_wiphy_work")
| stats count min(_time) as firstTime max(_time) as lastTime by host
| convert ctime(firstTime) ctime(lastTime)

Wazuh OSSEC Rule

<group name="linux,kernel,mac80211,">
  <rule id="100983" level="6">
    <decoded_as>syslog</decoded_as>
    <match>ieee80211_start_next_roc|offchannel.c:404|__ieee80211_scan_completed|cfg80211_wiphy_work</match>
    <description>CVE-2026-98337: mac80211 ROC/scan race warning detected in kernel log</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>kernel_warning,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations: Reduce exposure by limiting the ability of untrusted local users or processes to perform Wi-Fi scan/ROC operations (restrict CAP_NET_ADMIN on wireless phys). On affected endpoints, avoid running scan workflows concurrently with off-channel operations. Monitor kernel logs for the ieee80211_start_next_roc/offchannel.c:404 warning to identify impacted devices.

2. Patch/upgrade steps: Track the upstream Linux kernel commit series for "wifi: mac80211: don't start a ROC while scanning" and apply the vendor kernel update once available. Validate that the running kernel contains the fix before declaring remediation complete.

3. Long-term hardening: Enforce kernel patch management for wireless-enabled Linux devices; apply stable/long-term (LTS) kernel updates regularly; test Wi-Fi scan and off-channel workloads in staging to catch regressions early.

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-98337
• https://git.kernel.org/ (search: "wifi: mac80211: don't start a ROC while scanning")
• https://www.kernel.org/ (Linux kernel stable releases)
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98337
• CISA KEV: not listed as of report generation. No known threat actor campaigns or exploit-in-the-wild evidence.