CVE-2026-98706: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-24rr-93xv-vqrr
Share
Published
Advisory Summary

CVE-2026-98706 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-98706 at a Glance

CVE Identifier CVE-2026-98706
GHSA Identifier GHSA-24rr-93xv-vqrr
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-98706

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-98706, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drain PS delivery work during station teardown Removing an AP or mesh station can notify the driver and wake TXQs after the station has already been removed from the driver, and can update num_sta_ps and the power-save queues after station cleanup has purged them. sta_deliver_ps_frames() tests sta->dead only before it starts delivery. A worker that passes that test can be delayed while teardown sets sta->dead and removes the station from the driver; when it resumes it still runs the full delivery. The existing cancel_work_sync() sits near the end of __cleanup_single_sta(), after the final driver state transition and after PS accounting and queue purging, so it drains the worker only once the state it has to protect has already changed. Before commit d34ba2168a3c ("mac80211: don't delay station destruction") cleanup was deferred through the same ordered workqueue as the delivery work, which kept the two ordered. Cancel the work after setting sta->dead and before moving the driver state, and move the existing cancellation to the start of __cleanup_single_sta(). The first drain closes the driver-lifetime window; driver callbacks during the remaining state transitions can still queue drv_deliver_wk through ieee80211_sta_block_awake(), so retain the second drain at the start of __cleanup_single_sta(). That drain also covers insertion failures, which reach cleanup without setting sta->dead.

References

NVD — CVE-2026-98706 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-98706
git.kernel.org/stable/c/097460fcdd... WEB
https://git.kernel.org/stable/c/097460fcdd8ab9ef6f6018b2fdc29ba0ea499298
git.kernel.org/stable/c/67a9e80c3c... WEB
https://git.kernel.org/stable/c/67a9e80c3ca20c9044cd6ee72cd6278dd19b5023
git.kernel.org/stable/c/772bd89304... WEB
https://git.kernel.org/stable/c/772bd89304ecf057cc51ce4ce24a1a96ac9c8de3
git.kernel.org/stable/c/843d3a1e6f... WEB
https://git.kernel.org/stable/c/843d3a1e6f25027ac85f88f67b95d82c67306dee

Frequently Asked Questions

What is CVE-2026-98706?
CVE-2026-98706 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-98706?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-98706?
CVE-2026-98706 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-98706?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-24rr-93xv-vqrr",
  "modified" : "2026-10-18T18:32:00Z",
  "published" : "2026-10-18T18:32:00Z",
  "aliases" : [ "CVE-2026-98706" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: drain PS delivery work during station teardown\n\nRemoving an AP or mesh station can notify the driver and wake TXQs after\nthe station has already been removed from the driver, and can update\nnum_sta_ps and the power-save queues after station cleanup has purged\nthem.\n\nsta_deliver_ps_frames() tests sta->dead only before it starts delivery. A\nworker that passes that test can be delayed while teardown sets sta->dead\nand removes the station from the driver; when it resumes it still runs the\nfull delivery.\n\nThe existing cancel_work_sync() sits near the end of\n__cleanup_single_sta(), after the final driver state transition and after\nPS accounting and queue purging, so it drains the worker only once the\nstate it has to protect has already changed. Before commit d34ba2168a3c\n(\"mac80211: don't delay station destruction\") cleanup was deferred\nthrough the same ordered workqueue as the delivery work, which kept the\ntwo ordered.\n\nCancel the work after setting sta->dead and before moving the driver\nstate, and move the existing cancellation to the start of\n__cleanup_single_sta(). The first drain closes the driver-lifetime window;\ndriver callbacks during the remaining state transitions can still queue\ndrv_deliver_wk through ieee80211_sta_block_awake(), so retain the second\ndrain at the start of __cleanup_single_sta(). That drain also covers\ninsertion failures, which reach cleanup without setting sta->dead.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-98706"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/097460fcdd8ab9ef6f6018b2fdc29ba0ea499298"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/67a9e80c3ca20c9044cd6ee72cd6278dd19b5023"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/772bd89304ecf057cc51ce4ce24a1a96ac9c8de3"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/843d3a1e6f25027ac85f88f67b95d82c67306dee"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-10-18T16:17:24Z"
  }
}