wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue()
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue() ieee80211_monitor_select_queue() validates the skb length using skb->len before dereferencing pointers into skb->data to access the 802.11 header. However, skb->len includes data in both the linear head buffer and non-linear fragments/pages. When AF_PACKET sends a packet large enough to become non-linear, the 802.11 header at skb->data + len_rthdr may extend past the linear head buffer even though skb->len appears sufficient. This leads to a slab-out-of-bounds read when accessing hdr->frame_control, as the kernel reads beyond the allocated skb head buffer: BUG: KASAN: slab-out-of-bounds in ieee80211_monitor_select_queue+0x1ed/0x220 syzbot has hit the same issues. Fix this by checking skb_headlen(skb) (which gives the length of the linear data region) instead of skb->len before dereferencing skb->data pointers. This ensures the required bytes are actually present in the linear portion of the skb. Apply the same fix to ieee80211_validate_radiotap_len() which has the same class of bug: it uses skb->len to validate accesses to skb->data, and to the corresponding checks in ieee80211_monitor_start_xmit(): for drivers advertising NETIF_F_SG the skb is not linearized before ndo_start_xmit, so the 802.11 header can be read past the linear buffer there as well.
CVE-2026-98810
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-98810
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "9b8a74e3482f9fc077a88c13fa0ceca8feb0b772",
"lessThan": "63e7064b4c1c4b540bf2f0cba47384f92ab95307",
"versionType": "git"
},
{
"status": "affected",
"version": "9b8a74e3482f9fc077a88c13fa0ceca8feb0b772",
"lessThan": "6f63e919fe1e335b8abcb3a28bfd4804a98d875a",
"versionType": "git"
}
],
"programFiles": [
"net/mac80211/iface.c",
"net/mac80211/tx.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.24"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "2.6.24",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/mac80211/iface.c",
"net/mac80211/tx.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-98810
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #38732 · Revision 1
- Added to Heist Feed
- Publisher date