CVE-2026-98890

wifi: libertas: reject short monitor TX frames

State: Published
Severity: Not scored
Published: Oct 23, 2026
Updated: Oct 26, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: libertas: reject short monitor TX frames

In monitor mode, lbs_hard_start_xmit() casts skb->data to a radiotap TX header, skips that header, and then copies the 802.11 destination address from offset 4 in the remaining frame. The generic length check only rejects zero-length and oversized skbs, so a short monitor frame can be read past the end of the skb data.

Require enough bytes for the radiotap TX header and the destination address field before using the monitor-mode header layout.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	876c9d3aeb989cf1961f2c228d309ba5dcfb1172 to before 68c92c991ddb75dfd3fd62a94a1d4d2dde44dc3cAffected 876c9d3aeb989cf1961f2c228d309ba5dcfb1172 to before d865dd6de8295f2bfaa83f0f5d49d2bef1543065Affected 876c9d3aeb989cf1961f2c228d309ba5dcfb1172 to before 6576baa3fdbaa91fa75e4ba27095f4b8a27349a8Affected 876c9d3aeb989cf1961f2c228d309ba5dcfb1172 to before b657cc98d7936c5d9ed7e0e1944ad0e1f36375bbAffected 876c9d3aeb989cf1961f2c228d309ba5dcfb1172 to before 443fac3de65c76544b450b9f9903be8989150d55Affected 876c9d3aeb989cf1961f2c228d309ba5dcfb1172 to before cdcfd662c67833d89ee3d912efde2eb67c8a7326Affected 876c9d3aeb989cf1961f2c228d309ba5dcfb1172 to before 13ff543e0b2c713aedeaadadde686686e949dc78Affected
LinuxLinux	2.6.22Affected before 2.6.22Not affected 5.10.271 through 5.10.Not affected 5.15.222 through 5.15.Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.111 through 6.12.Not affected 6.18.53 through 6.18.Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

876c9d3aeb989cf1961f2c228d309ba5dcfb1172 to before 68c92c991ddb75dfd3fd62a94a1d4d2dde44dc3cAffected
876c9d3aeb989cf1961f2c228d309ba5dcfb1172 to before d865dd6de8295f2bfaa83f0f5d49d2bef1543065Affected
876c9d3aeb989cf1961f2c228d309ba5dcfb1172 to before 6576baa3fdbaa91fa75e4ba27095f4b8a27349a8Affected
876c9d3aeb989cf1961f2c228d309ba5dcfb1172 to before b657cc98d7936c5d9ed7e0e1944ad0e1f36375bbAffected
876c9d3aeb989cf1961f2c228d309ba5dcfb1172 to before 443fac3de65c76544b450b9f9903be8989150d55Affected
876c9d3aeb989cf1961f2c228d309ba5dcfb1172 to before cdcfd662c67833d89ee3d912efde2eb67c8a7326Affected
876c9d3aeb989cf1961f2c228d309ba5dcfb1172 to before 13ff543e0b2c713aedeaadadde686686e949dc78Affected

LinuxLinux

2.6.22Affected
before 2.6.22Not affected
5.10.271 through 5.10.*Not affected
5.15.222 through 5.15.*Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.111 through 6.12.*Not affected
6.18.53 through 6.18.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.