Riskcovery

CVE-2026-98887

wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO

State
Published
Severity
Not scored
Published
Oct 23, 2026
Updated
Oct 26, 2026
Reserved
Sep 25, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO

hwsim_tx_info_frame_received_nl() casts the HWSIM_ATTR_TX_INFO payload to a struct hwsim_tx_rate * and unconditionally reads IEEE80211_TX_MAX_RATES entries (8 bytes) from it. The policy only bounds the attribute from above (NLA_BINARY .len is a maximum) and the op sets GENL_DONT_VALIDATE_STRICT, so a short or zero-length attribute is accepted and the loop reads past the payload.

Require the exact length in the policy, so a malformed attribute is rejected before the handler runs.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 5d44fe7c9808c56e136e59147bd932f5491520f1 to before 3a96bb65b4b820d8b41fa155781ec1c29e3479d4Affected
  • 5d44fe7c9808c56e136e59147bd932f5491520f1 to before 59e1f2a0242232b4a3af144ae317d3913fc09046Affected
  • 5d44fe7c9808c56e136e59147bd932f5491520f1 to before 1ae85bb34fe3510659b86d6a5f8036dd498233f8Affected
  • 5d44fe7c9808c56e136e59147bd932f5491520f1 to before 6f6368b20f8c9481fa7ba7b672dcb3c9f36b2695Affected
  • 5d44fe7c9808c56e136e59147bd932f5491520f1 to before b5b1234bbfa25537fb9a5c0d62c328ed4547f721Affected
  • 5d44fe7c9808c56e136e59147bd932f5491520f1 to before 13edd8ea7ff2ce6a964b290ef2034cd8cbed96c7Affected
  • 5d44fe7c9808c56e136e59147bd932f5491520f1 to before 3dc723ac78a6e4fa0fd49e27e487ed319da40a9fAffected
LinuxLinux
  • 5.7Affected
  • before 5.7Not affected
  • 5.10.271 through 5.10.*Not affected
  • 5.15.222 through 5.15.*Not affected
  • 6.1.189 through 6.1.*Not affected
  • 6.6.158 through 6.6.*Not affected
  • 6.12.111 through 6.12.*Not affected
  • 6.18.53 through 6.18.*Not affected
  • 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.