CVE-2026-63869
Received Received - Intake

Integer Underflow in Linux Kernel WiFi Subsystem

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap When parsing the radiotap header of an injected frame, ieee80211_parse_tx_radiotap() uses the IEEE80211_RADIOTAP_ANTENNA value directly as a shift count: info->control.antennas |= BIT(*iterator.this_arg); *iterator.this_arg is an 8-bit value taken straight from the frame supplied by userspace, so BIT() can be asked to shift by up to 255. That is undefined behaviour on the unsigned long and is reported by UBSAN: UBSAN: shift-out-of-bounds in net/mac80211/tx.c:2174:30 shift exponent 235 is too large for 64-bit type 'unsigned long' Call Trace: ieee80211_parse_tx_radiotap+0xadb/0x1950 net/mac80211/tx.c:2174 ieee80211_monitor_start_xmit+0xb1f/0x1250 net/mac80211/tx.c:2451 ... packet_sendmsg+0x3eb6/0x50f0 net/packet/af_packet.c:3109 info->control.antennas is a 2-bit bitmap (u8 antennas:2), so only antenna indices 0 and 1 can ever be represented. Ignore any larger value instead of shifting out of bounds.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63869
EUVD
EUVD-2026-45554

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's WiFi subsystem. When processing a radiotap header in an injected network frame, the code uses a value from the frame directly as a shift count without validation. This can cause undefined behavior, including out-of-bounds shifts, leading to potential crashes or security issues.

Detection Guidance

This vulnerability is related to the Linux kernel's WiFi subsystem and can be detected by checking for kernel logs indicating a shift-out-of-bounds error in the mac80211 module. Use the command 'dmesg | grep -i "shift-out-of-bounds"' to search for such errors. Additionally, monitor for crashes or unusual behavior in WiFi-related processes.

Impact Analysis

An attacker could exploit this to cause a kernel crash or trigger undefined behavior by sending a maliciously crafted network frame. This may lead to denial-of-service conditions or potential privilege escalation if combined with other vulnerabilities.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-level kernel issue in the Linux WiFi subsystem that could lead to undefined behavior during frame injection. No evidence suggests it impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

To mitigate this vulnerability, update your Linux kernel to the latest stable version that includes the fix. If an update is not immediately available, consider disabling monitor mode on WiFi interfaces or restricting untrusted userspace applications from injecting frames. Monitor kernel security advisories for patches.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63869. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart