CVE-2026-98810
Received Received - Intake

Buffer Overflow in Linux Kernel WiFi Subsystem

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue() ieee80211_monitor_select_queue() validates the skb length using skb->len before dereferencing pointers into skb->data to access the 802.11 header. However, skb->len includes data in both the linear head buffer and non-linear fragments/pages. When AF_PACKET sends a packet large enough to become non-linear, the 802.11 header at skb->data + len_rthdr may extend past the linear head buffer even though skb->len appears sufficient. This leads to a slab-out-of-bounds read when accessing hdr->frame_control, as the kernel reads beyond the allocated skb head buffer: BUG: KASAN: slab-out-of-bounds in ieee80211_monitor_select_queue+0x1ed/0x220 syzbot has hit the same issues. Fix this by checking skb_headlen(skb) (which gives the length of the linear data region) instead of skb->len before dereferencing skb->data pointers. This ensures the required bytes are actually present in the linear portion of the skb. Apply the same fix to ieee80211_validate_radiotap_len() which has the same class of bug: it uses skb->len to validate accesses to skb->data, and to the corresponding checks in ieee80211_monitor_start_xmit(): for drivers advertising NETIF_F_SG the skb is not linearized before ndo_start_xmit, so the 802.11 header can be read past the linear buffer there as well.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98810
EUVD
EUVD-2026-103895

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Linux Linux 9b8a74e3482f9fc077a88c13fa0ceca8feb0b772
Linux Linux 9b8a74e3482f9fc077a88c13fa0ceca8feb0b772
Linux Linux 2.6.24

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a slab-out-of-bounds read vulnerability in the Linux kernel's wifi subsystem. It occurs in the mac80211 module when processing packets. The function ieee80211_monitor_select_queue() incorrectly validates packet length using skb->len, which includes both linear and non-linear data. This can cause the kernel to read beyond the allocated buffer when accessing the 802.11 header in non-linear packets.

Detection Guidance

This vulnerability is specific to the Linux kernel's mac80211 subsystem and may not have direct detection commands. However, you can check for slab-out-of-bounds errors in kernel logs using: dmesg | grep -i 'KASAN: slab-out-of-bounds' or monitor kernel logs for crashes related to ieee80211_monitor_select_queue.

Impact Analysis

This vulnerability could allow an attacker to cause a kernel crash or potentially execute arbitrary code with kernel privileges. It specifically affects systems using WiFi in monitor mode with AF_PACKET sockets sending large packets. The impact includes denial of service through system crashes.

Mitigation Strategies

Apply the latest Linux kernel security patches that include the fix for CVE-2026-98810. Update your kernel to a patched version where ieee80211_monitor_select_queue() and related functions use skb_headlen() instead of skb->len for validation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98810. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart