CVE-2026-68411
Received Received - Intake

Buffer Overflow in Linux Kernel wifi mac80211_hwsim

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: clamp virtio RX length before skb_put hwsim_virtio_rx_work() passes the virtqueue used-ring length reported by the device straight to skb_put() on a fixed-size receive skb. A backend reporting a length larger than the skb tailroom drives skb_put() past the buffer end and hits skb_over_panic() -- a host-triggerable guest panic (denial of service). Clamp the length to the skb's available room before skb_put(). A conforming device never reports more than the posted buffer size, so valid frames are unaffected; a truncated over-report then fails the length/header checks in hwsim_virtio_handle_cmd() and is dropped, so truncating rather than dropping here cannot be turned into a parsing problem.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68411
EUVD
EUVD-2026-55597

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the mac80211_hwsim module where a virtual Wi-Fi device driver incorrectly handles data received from a virtual queue. The driver passes an unchecked length value from the device directly to a function that expands a network buffer, potentially writing past the buffer's allocated space. This causes a kernel panic, leading to a denial of service on the host system.

Detection Guidance

This vulnerability is specific to the Linux kernel's mac80211_hwsim module and involves improper handling of virtio RX length. Detection requires checking kernel logs for skb_over_panic errors or host-triggerable guest panics related to hwsim_virtio_rx_work. Monitor system logs for crashes or kernel oopses in virtualized environments using mac80211_hwsim.

Impact Analysis

If you are running a system with a vulnerable Linux kernel version, an attacker with access to a virtual Wi-Fi device could trigger this flaw to crash your system, causing a denial of service. This could disrupt services or require a system reboot to recover.

Mitigation Strategies

Apply the Linux kernel patch that clamps virtio RX length before skb_put. Update to a kernel version containing the fix. If immediate patching is not possible, disable the mac80211_hwsim module if unused to prevent potential exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68411. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart