CVE-2026-98958 Linux CVE debrief

Who should care

Linux system administrators, security teams, and deployment personnel should assess exposure and prioritize patching to prevent potential blocking of stations. Affected operators include those managing Linux systems using the mt76 driver. Vulnerability management and security teams should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Why it matters

CVE-2026-98958 is a Linux kernel vulnerability that requires verification of affected versions and systems, and prioritization of patching to prevent potential blocking of stations.

• Verify Linux system inventory and check for affected versions
• Prioritize patching for Linux systems
• Assess potential blocking of stations due to non-AQL frame accounting

Technical summary

The Linux kernel vulnerability (CVE-2026-98958) relates to accounting non-AQL frames per peer rather than per link, which could block stations. The issue has been resolved by maintaining the count on the wcid of the primary link. The driver increments wcid->non_aql_packets when a frame goes to the hardware queue. The completion path decrements the counter again. For an MLO peer, the hardware reports the completion on the link that it used for the transmission. This link can differ from the link that the driver queued the frame on.

Defensive priority

Assess exposure in Linux deployments, verify inventory, and prioritize patching for affected systems.

Recommended defensive actions

• Assess Linux system exposure and prioritize patching
• Verify inventory of Linux systems and check for affected versions
• Apply patches or updates provided by Linux vendors
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, but additional verification is needed to confirm affected versions and systems. The vulnerability is related to the mt76 driver in the Linux kernel. The driver increments wcid->non_aql_packets when a frame goes to the hardware queue. The completion path decrements the counter again. For an MLO peer, the hardware reports the completion on the link that it used for the transmission. This link can differ from the link that the driver queued the frame on.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.