CVE-2026-98958

Not scored yetLast modified Oct 23, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: account non-AQL frames per peer rather than per link

The driver increments wcid->non_aql_packets when a frame goes to the hardware queue. The completion path decrements the counter again.

For an MLO peer, the hardware reports the completion on the link that it used for the transmission. This link can differ from the link that the driver queued the frame on. In that case, the increment and the decrement go to different link wcids, and the count drifts upwards until it blocks the station.

Keep the count on the wcid of the primary link, like the other peer-wide state.

Metrics

No CVSS score has been published yet.

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 23, 2026
Last modified
Oct 23, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-989599.8In the Linux kernel, the following vulnerability has been resolved: btrfs: fix xattr replace when multiple xattrs are packed in the same itCVE-2026-98968.8Out of bounds write in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via CVE-2026-98960In the Linux kernel, the following vulnerability has been resolved: btrfs: don't stash io_uring encoded data across -EAGAIN Returning -EAGCVE-2026-98961In the Linux kernel, the following vulnerability has been resolved: btrfs: unlock inode and extent in caller when io_uring read extent failCVE-2026-98962In the Linux kernel, the following vulnerability has been resolved: btrfs: free iov when btrfs_uring_read_extent() fails After btrfs_uringCVE-2026-98963In the Linux kernel, the following vulnerability has been resolved: btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio CVE-2026-989647.5In the Linux kernel, the following vulnerability has been resolved: nvmet: use the local P2P device on metadata allocation failure nvmet_rCVE-2026-989657.5In the Linux kernel, the following vulnerability has been resolved: ice: Restore Ordered MMIO Writes for Tx Doorbells The DQL accounting sCVE-2026-98966In the Linux kernel, the following vulnerability has been resolved: bonding: fix the program leak when XDP is replaced We need to release CVE-2026-98967In the Linux kernel, the following vulnerability has been resolved: cxgb4/ch_ktls: disable softirqs around tid_list erases chcr_ktls_cpl_aCVE-2026-989688.1In the Linux kernel, the following vulnerability has been resolved: amt: send the relay's General Query directly from the receive path An CVE-2026-98969In the Linux kernel, the following vulnerability has been resolved: net/sched: em_text: reject unterminated algo before autoload This is a
CVE-2026-98958: Unscored | Vulnix