SB20261022426 - Out-of-bounds read in Linux kernel mac80211

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds read (CVE-ID: CVE-2026-98810)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to potentially cause a denial of service by triggering an out-of-bounds kernel memory read.

The vulnerability exists due to an out-of-bounds read in the Linux kernel mac80211 monitor packet handling functions when processing non-linear packets. Length checks use the total packet length, including non-linear fragments, rather than the length of the linear head buffer containing the accessed headers. A local privileged user can send specially crafted packets through AF_PACKET to trigger reads beyond the allocated head buffer, potentially causing a kernel crash.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/63e7064b4c1c4b540bf2f0cba47384f92ab95307
• https://git.kernel.org/stable/c/6f63e919fe1e335b8abcb3a28bfd4804a98d875a