SB20260720410 - Out-of-bounds write in Linux kernel mac80211

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds write (CVE-ID: CVE-2026-63869)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds shift in ieee80211_parse_tx_radiotap() when parsing the radiotap header of an injected frame. A local user can supply a crafted frame from userspace to cause a denial of service.

The issue is triggered by the IEEE80211_RADIOTAP_ANTENNA value being used directly as a shift count, and larger antenna indices cannot be represented by the 2-bit bitmap.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/033ce021a220913ac02416fcb5ac883a9ff8b6c7
• https://git.kernel.org/stable/c/6c0cf89f36ac0c0fd8687a4ccdce2efb23a9c663
• https://git.kernel.org/stable/c/9b40c59bab08f2a99abf969cc0bb92fa49de004b
• https://git.kernel.org/stable/c/f6d3dc8e8492bf8435e0b23c99472af7bafd6b44