CVE-2026-98406: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-9hw7-47p3-c6fj
Share
Published
Advisory Summary

CVE-2026-98406 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-98406 at a Glance

CVE Identifier CVE-2026-98406
GHSA Identifier GHSA-9hw7-47p3-c6fj
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-98406

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-98406, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver ieee80211_set_bitrate_mask() checks if the interface is running via ieee80211_sdata_running(), but it does not check if the interface is still present in the driver. When sdata is running but IEEE80211_SDATA_IN_DRIVER is not set, the call reaches drv_set_bitrate_mask() in driver-ops.h which hits wlan1: Failed check-sdata-in-driver check, flags: 0x0 WARNING: net/mac80211/driver-ops.h:884 at drv_set_bitrate_mask Syzkaller triggers this via wext SIOCSIWRATE ioctl. The Call Trace shows wext_ioctl_dispatch() in wext-core.c dispatching the ioctl, calling ioctl_standard_call() for SIOCSIWRATE, which calls cfg80211_wext_siwrate() in wext-compat.c. That builds a bitrate mask and calls rdev_set_bitrate_mask() which ends up in ieee80211_set_bitrate_mask() in cfg.c. The interface is marked running via SDATA_STATE_RUNNING but flags is 0, so check_sdata_in_driver() fails. When the interface is being torn down, or when wext ioctl is issued during interface bringup before drv_add_interface() sets IN_DRIVER, the running check passes while IN_DRIVER is clear. Check IEEE80211_SDATA_IN_DRIVER in ieee80211_set_bitrate_mask() before calling the driver, returning -ENETDOWN. This avoids the WARN_ONCE in driver-ops.h and matches other cfg.c operations that bail early when not in driver. This change should be safe because wiphy mutex is held in cfg80211_wext_siwrate() via guard(wiphy), and IN_DRIVER is set/cleared under RTNL and wiphy paths in drv_add_interface() and drv_remove_interface() in driver-ops.c, so the check is race-free against driver add/remove. Returning -ENETDOWN is the same error other not-running paths use and does not introduce new locking. [also add second syzbot report]

References

NVD — CVE-2026-98406 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-98406
git.kernel.org/stable/c/0d1700394e... WEB
https://git.kernel.org/stable/c/0d1700394e9f5d0bd9bebad8d5a50edf983f52fd
git.kernel.org/stable/c/4095b66aca... WEB
https://git.kernel.org/stable/c/4095b66acae9893dd13deb39a4331651cb2f822b
git.kernel.org/stable/c/432c8532d5... WEB
https://git.kernel.org/stable/c/432c8532d5ccc2af77da43ed6ef1c80495a4efe8
git.kernel.org/stable/c/4ba86c44b2... WEB
https://git.kernel.org/stable/c/4ba86c44b2fcb1c3175caa2456b6d58f483446ab
git.kernel.org/stable/c/7978dda63d... WEB
https://git.kernel.org/stable/c/7978dda63d2b109ea9c3f7a096cd1aac6542cd54
git.kernel.org/stable/c/c2cd9c4477... WEB
https://git.kernel.org/stable/c/c2cd9c44777cf97be3e35c10b7c2d8f59ebb9306
git.kernel.org/stable/c/c4ee5685af... WEB
https://git.kernel.org/stable/c/c4ee5685af444024e6222ce29f6ed36adc44ffc3
git.kernel.org/stable/c/da2ca406f4... WEB
https://git.kernel.org/stable/c/da2ca406f45a6e21760243152ed8d2e8e72915c2

Frequently Asked Questions

What is CVE-2026-98406?
CVE-2026-98406 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-98406?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-98406?
CVE-2026-98406 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-98406?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-9hw7-47p3-c6fj",
  "modified" : "2026-10-14T15:32:20Z",
  "published" : "2026-10-14T15:32:20Z",
  "aliases" : [ "CVE-2026-98406" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver\n\nieee80211_set_bitrate_mask() checks if the interface is running via\nieee80211_sdata_running(), but it does not check if the interface is\nstill present in the driver.\n\nWhen sdata is running but IEEE80211_SDATA_IN_DRIVER is not set, the\ncall reaches drv_set_bitrate_mask() in driver-ops.h which hits\n\n  wlan1: Failed check-sdata-in-driver check, flags: 0x0\n  WARNING: net/mac80211/driver-ops.h:884 at drv_set_bitrate_mask\n\nSyzkaller triggers this via wext SIOCSIWRATE ioctl. The Call Trace shows\nwext_ioctl_dispatch() in wext-core.c dispatching the ioctl, calling\nioctl_standard_call() for SIOCSIWRATE, which calls cfg80211_wext_siwrate()\nin wext-compat.c. That builds a bitrate mask and calls\nrdev_set_bitrate_mask() which ends up in ieee80211_set_bitrate_mask() in\ncfg.c. The interface is marked running via SDATA_STATE_RUNNING but\nflags is 0, so check_sdata_in_driver() fails.\n\nWhen the interface is being torn down, or when wext ioctl is issued\nduring interface bringup before drv_add_interface() sets IN_DRIVER, the\nrunning check passes while IN_DRIVER is clear.\n\nCheck IEEE80211_SDATA_IN_DRIVER in ieee80211_set_bitrate_mask() before\ncalling the driver, returning -ENETDOWN. This avoids the WARN_ONCE in\ndriver-ops.h and matches other cfg.c operations that bail early when not\nin driver.\n\nThis change should be safe because wiphy mutex is held in\ncfg80211_wext_siwrate() via guard(wiphy), and IN_DRIVER is set/cleared\nunder RTNL and wiphy paths in drv_add_interface() and\ndrv_remove_interface() in driver-ops.c, so the check is race-free\nagainst driver add/remove. Returning -ENETDOWN is the same error other\nnot-running paths use and does not introduce new locking.\n\n[also add second syzbot report]",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-98406"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/0d1700394e9f5d0bd9bebad8d5a50edf983f52fd"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/4095b66acae9893dd13deb39a4331651cb2f822b"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/432c8532d5ccc2af77da43ed6ef1c80495a4efe8"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/4ba86c44b2fcb1c3175caa2456b6d58f483446ab"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/7978dda63d2b109ea9c3f7a096cd1aac6542cd54"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/c2cd9c44777cf97be3e35c10b7c2d8f59ebb9306"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/c4ee5685af444024e6222ce29f6ed36adc44ffc3"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/da2ca406f45a6e21760243152ed8d2e8e72915c2"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-10-14T14:17:51Z"
  }
}