CVE-2026-98345

wifi: cfg80211: check IP header size in cfg80211_classify8021d()

State: Published
Severity: Not scored
Published: Oct 6, 2026
Updated: Oct 19, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: check IP header size in cfg80211_classify8021d()

A frame that looks like IP can be transmitted, but be too short, so the DS field is read incorrectly:

BUG: KMSAN: uninit-value in cfg80211_classify8021d+0x99d/0x12b0 net/wireless/util.c:1027 cfg80211_classify8021d+0x99d/0x12b0 net/wireless/util.c:1027 ieee80211_select_queue+0x37a/0x9e0 net/mac80211/wme.c:180 __ieee80211_subif_start_xmit+0x60f/0x1d90 net/mac80211/tx.c:4304 ieee80211_subif_start_xmit+0xa8/0x6d0 net/mac80211/tx.c:4538 ... packet_sendmsg+0x9173/0xa2a0 net/packet/af_packet.c:3108

Use skb_header_pointer() like the MPLS case.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	e31a16d6f64ef0e324c6f54d5112703c3f13a9c4 to before 18d5547327c202cda33ad2bbd203220c2c62c8a7Affected e31a16d6f64ef0e324c6f54d5112703c3f13a9c4 to before 3ff17ffa8d02e0e3f6b2f6e57af4aac511f5b734Affected e31a16d6f64ef0e324c6f54d5112703c3f13a9c4 to before c4fbcf1e614ef0755fcc751fdfca21b0bf4e0ef7Affected e31a16d6f64ef0e324c6f54d5112703c3f13a9c4 to before 12c0abd4d1c1b04a7663d04ba85268bc9ad9c017Affected e31a16d6f64ef0e324c6f54d5112703c3f13a9c4 to before f33ad4e2f846e55cf4637419268f093ac9f1a765Affected e31a16d6f64ef0e324c6f54d5112703c3f13a9c4 to before a2cdb4a675ca04c4ac8cc962848082d8ce065008Affected e31a16d6f64ef0e324c6f54d5112703c3f13a9c4 to before 65893c8d28f239c7ddad5a83683be193a9133e9bAffected e31a16d6f64ef0e324c6f54d5112703c3f13a9c4 to before 48b2c5c628b09cf36cbeca53e0432fc2a7518be7Affected
LinuxLinux	2.6.31Affected before 2.6.31Not affected 5.10.271 through 5.10.Not affected 5.15.222 through 5.15.Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.112 through 6.12.Not affected 6.18.54 through 6.18.Not affected 7.2.8 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

e31a16d6f64ef0e324c6f54d5112703c3f13a9c4 to before 18d5547327c202cda33ad2bbd203220c2c62c8a7Affected
e31a16d6f64ef0e324c6f54d5112703c3f13a9c4 to before 3ff17ffa8d02e0e3f6b2f6e57af4aac511f5b734Affected
e31a16d6f64ef0e324c6f54d5112703c3f13a9c4 to before c4fbcf1e614ef0755fcc751fdfca21b0bf4e0ef7Affected
e31a16d6f64ef0e324c6f54d5112703c3f13a9c4 to before 12c0abd4d1c1b04a7663d04ba85268bc9ad9c017Affected
e31a16d6f64ef0e324c6f54d5112703c3f13a9c4 to before f33ad4e2f846e55cf4637419268f093ac9f1a765Affected
e31a16d6f64ef0e324c6f54d5112703c3f13a9c4 to before a2cdb4a675ca04c4ac8cc962848082d8ce065008Affected
e31a16d6f64ef0e324c6f54d5112703c3f13a9c4 to before 65893c8d28f239c7ddad5a83683be193a9133e9bAffected
e31a16d6f64ef0e324c6f54d5112703c3f13a9c4 to before 48b2c5c628b09cf36cbeca53e0432fc2a7518be7Affected

LinuxLinux

2.6.31Affected
before 2.6.31Not affected
5.10.271 through 5.10.*Not affected
5.15.222 through 5.15.*Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.112 through 6.12.*Not affected
6.18.54 through 6.18.*Not affected
7.2.8 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.