CVE-2026-98703

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: minstrel ht: validate fixed rate index

The fixed rate idx debugfs file is a plain u32 attribute, so any value can be written to it. minstrel ht update stats() then copies the value into mi->max tp rate[] and mi->max prob rate, and minstrel ht set rate() uses MI RATE GROUP()/MI RATE IDX() to index minstrel mcs groups[] (42 entries) and mi->groups[].rates[] (10 entries) with it.

Writing e.g. 65535 selects group 4095 and rate index 15, far outside both arrays. The out-of-bounds entries are dereferenced and updated as struct minstrel rate stats (retry counts, etc.), so the invalid index corrupts adjacent kernel memory. With CONFIG UBSAN BOUNDS the access is reported as an array-index-out-of-bounds in minstrel ht set rate().

Only a valid group/rate pair, or U32 MAX to disable fixed rate processing, can be used safely, so reject any other value when the debugfs file is written.

The file is only reachable through a root-only debugfs mount, so this is not a privilege boundary. The out-of-bounds access is still a bug that must not be reachable through a writable debugfs attribute.