GHSA-873V-4WM2-M9CR
Vulnerability from github – Published: 2026-10-18 18:32 – Updated: 2026-10-30 15:33In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: handle empty FILS association request payload
fils_encrypt_assoc_req() accepts a (Re)Association Request frame whose last element is the FILS Session element. crypt_len is then zero and aes_siv_encrypt() is called with an empty plaintext.
kmemdup() returns ZERO_SIZE_PTR for a zero-length allocation, so the unconditional sg_init_one() puts an invalid page into the scatterlist. With CONFIG_DEBUG_SG this triggers a kernel BUG in sg_set_buf(); without the debug check the bogus page is handed to the crypto backend.
AES-SIV is defined for empty plaintext and the S2V result is then the complete output, so handle this case before the CTR step, which has nothing to encrypt.
{
"affected": [],
"aliases": [
"CVE-2026-98698"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-18T16:17:23Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: handle empty FILS association request payload\n\nfils_encrypt_assoc_req() accepts a (Re)Association Request frame whose\nlast element is the FILS Session element. crypt_len is then zero and\naes_siv_encrypt() is called with an empty plaintext.\n\nkmemdup() returns ZERO_SIZE_PTR for a zero-length allocation, so the\nunconditional sg_init_one() puts an invalid page into the scatterlist.\nWith CONFIG_DEBUG_SG this triggers a kernel BUG in sg_set_buf();\nwithout the debug check the bogus page is handed to the crypto backend.\n\nAES-SIV is defined for empty plaintext and the S2V result is then the\ncomplete output, so handle this case before the CTR step, which has\nnothing to encrypt.",
"id": "GHSA-873v-4wm2-m9cr",
"modified": "2026-10-30T15:33:56Z",
"published": "2026-10-18T18:32:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98698"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0b1e4a7eeb6a301ee33bd318982927cbdbae9f36"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/20f939b0c151d1d28e6b62a76b2454fa6fe877f2"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2f5b62f6534d336a62fdb9e88b186dd70b4323ef"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/452f1c9b76f7a122bbc4630b9691bda4809677c4"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5bfd4b0b40b79781d900cb2f7da0685070f53c67"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ce70c87252a14020cb40032efe208efc6e61b1ee"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d8c5dbbf584a1baaa008988ac64dd4495f7086bd"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/de3297c8e521c0b0ddc89ece6fee84e25da9ecf0"
}
],
"schema_version": "1.4.0",
"severity": []
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.