CVE-2026-98810

Received Received - Intake

Buffer Overflow in Linux Kernel WiFi Subsystem

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue() ieee80211_monitor_select_queue() validates the skb length using skb->len before dereferencing pointers into skb->data to access the 802.11 header. However, skb->len includes data in both the linear head buffer and non-linear fragments/pages. When AF_PACKET sends a packet large enough to become non-linear, the 802.11 header at skb->data + len_rthdr may extend past the linear head buffer even though skb->len appears sufficient. This leads to a slab-out-of-bounds read when accessing hdr->frame_control, as the kernel reads beyond the allocated skb head buffer: BUG: KASAN: slab-out-of-bounds in ieee80211_monitor_select_queue+0x1ed/0x220 syzbot has hit the same issues. Fix this by checking skb_headlen(skb) (which gives the length of the linear data region) instead of skb->len before dereferencing skb->data pointers. This ensures the required bytes are actually present in the linear portion of the skb. Apply the same fix to ieee80211_validate_radiotap_len() which has the same class of bug: it uses skb->len to validate accesses to skb->data, and to the corresponding checks in ieee80211_monitor_start_xmit(): for drivers advertising NETIF_F_SG the skb is not linearized before ndo_start_xmit, so the 802.11 header can be read past the linear buffer there as well.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98810

EUVD

EUVD-2026-103895

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	9b8a74e3482f9fc077a88c13fa0ceca8feb0b772
Linux	Linux	9b8a74e3482f9fc077a88c13fa0ceca8feb0b772
Linux	Linux	2.6.24

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a slab-out-of-bounds read vulnerability in the Linux kernel's wifi subsystem. It occurs in the mac80211 module when processing packets. The function ieee80211_monitor_select_queue() incorrectly validates packet length using skb->len, which includes both linear and non-linear data. This can cause the kernel to read beyond the allocated buffer when accessing the 802.11 header in non-linear packets.

Detection Guidance

This vulnerability is specific to the Linux kernel's mac80211 subsystem and may not have direct detection commands. However, you can check for slab-out-of-bounds errors in kernel logs using: dmesg | grep -i 'KASAN: slab-out-of-bounds' or monitor kernel logs for crashes related to ieee80211_monitor_select_queue.

Impact Analysis

This vulnerability could allow an attacker to cause a kernel crash or potentially execute arbitrary code with kernel privileges. It specifically affects systems using WiFi in monitor mode with AF_PACKET sockets sending large packets. The impact includes denial of service through system crashes.

Compliance Impact

This vulnerability is a kernel memory corruption issue in the Linux wifi subsystem. It does not directly relate to data handling, encryption, or access controls that are typically the focus of GDPR or HIPAA compliance. The impact on compliance would be indirect if this bug leads to system instability, crashes, or unauthorized memory access that could compromise data integrity or confidentiality.

Mitigation Strategies

Apply the latest Linux kernel security patches that include the fix for CVE-2026-98810. Update your kernel to a patched version where ieee80211_monitor_select_queue() and related functions use skb_headlen() instead of skb->len for validation.

Hi! I’m here to help you understand CVE-2026-98810. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70