---
id: CVE-2026-98702
title: 'wifi: mac80211: reject invalid 320 MHz CSA bandwidth'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: mac80211: reject invalid 320 MHz CSA bandwidth

  The HT/VHT channel definition validator can receive a 320 MHz
  bandwidth indication from a received CSA frame on a …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 21c3f8f95554feff9bed15703e89adbe582e0383 <
    cf0ddacce173890407ed3fa50c8ea9b3c0cc0e16
  - >-
    Linux >= 21c3f8f95554feff9bed15703e89adbe582e0383 <
    1892e71aa2e5ee667d87c6e49e3661f5e290303b
  - >-
    Linux >= 21c3f8f95554feff9bed15703e89adbe582e0383 <
    79b3ce0d881cd6e5d4d3496b19f5cc5e7089a56c
  - >-
    Linux >= 21c3f8f95554feff9bed15703e89adbe582e0383 <
    56e236759f0a8dc910c2ae7cd3c161f298ee5794
  - Linux 6.9
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:46:32.122Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98702'
references:
  - url: 'https://git.kernel.org/stable/c/cf0ddacce173890407ed3fa50c8ea9b3c0cc0e16'
  - url: 'https://git.kernel.org/stable/c/1892e71aa2e5ee667d87c6e49e3661f5e290303b'
  - url: 'https://git.kernel.org/stable/c/79b3ce0d881cd6e5d4d3496b19f5cc5e7089a56c'
  - url: 'https://git.kernel.org/stable/c/56e236759f0a8dc910c2ae7cd3c161f298ee5794'
tags:
  - cve.org
ingestedAt: '2026-10-18T16:47:32.515Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: reject invalid 320 MHz CSA bandwidth

The HT/VHT channel definition validator can receive a 320 MHz
bandwidth indication from a received CSA frame on a non-6 GHz link.
It warns for this unsupported width but continues with an uninitialized
vht_operation.chan_width, which is then read by
ieee80211_chandef_vht_oper(). With panic_on_warn enabled, this lets a
received frame panic the kernel.

Reject the channel definition before entering the VHT operation
conversion. This preserves the existing CSA fallback while avoiding
both the warning and the uninitialized read.

## Affected

- `Linux >= 21c3f8f95554feff9bed15703e89adbe582e0383 < cf0ddacce173890407ed3fa50c8ea9b3c0cc0e16`
- `Linux >= 21c3f8f95554feff9bed15703e89adbe582e0383 < 1892e71aa2e5ee667d87c6e49e3661f5e290303b`
- `Linux >= 21c3f8f95554feff9bed15703e89adbe582e0383 < 79b3ce0d881cd6e5d4d3496b19f5cc5e7089a56c`
- `Linux >= 21c3f8f95554feff9bed15703e89adbe582e0383 < 56e236759f0a8dc910c2ae7cd3c161f298ee5794`
- `Linux 6.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.