Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Linux kernel may crash from crafted Wi‑Fi data
published 12 days ago
Summary
Versions of the Linux kernel older than 6.6.159.1‑1 can be tricked by a specially crafted Wi‑Fi packet to read data beyond its bounds, which can lead to a crash or other abnormal behavior. This occurs in the part of the kernel that simulates Wi‑Fi hardware. Updating the kernel to the latest version fixes the issue, so apply the current kernel patches as soon as possible.
What to do
- Update kernel to version 6.6.159.1-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | – | kernel |
< 6.6.159.1-1 Fix: upgrade to 6.6.159.1-1
|
| Azure Linux:3 | azure | kernel | <= 6.6.157.1-1 |
Original advisory text
CVE-2026-98887 affecting package kernel for versions less than 6.6.159.1-1
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO
hwsim_tx_info_frame_received_nl() casts the HWSIM_ATTR_TX_INFO payload
to a struct hwsim_tx_rate * and unconditionally reads
IEEE80211_TX_MAX_RATES entries (8 bytes) from it. The policy only bounds
the attribute from above (NLA_BINARY .len is a maximum) and the op sets
GENL_DONT_VALIDATE_STRICT, so a short or zero-length attribute is
accepted and the loop reads past the payload.
Require the exact length in the policy, so a malformed attribute is
rejected before the handler runs.
wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO
hwsim_tx_info_frame_received_nl() casts the HWSIM_ATTR_TX_INFO payload
to a struct hwsim_tx_rate * and unconditionally reads
IEEE80211_TX_MAX_RATES entries (8 bytes) from it. The policy only bounds
the attribute from above (NLA_BINARY .len is a maximum) and the op sets
GENL_DONT_VALIDATE_STRICT, so a short or zero-length attribute is
accepted and the loop reads past the payload.
Require the exact length in the policy, so a malformed attribute is
rejected before the handler runs.
References
Timeline
Published23 Oct 2026
Updated2 Nov 2026
First seen24 Oct 2026
Sources
AZL-110626 · OSV
Track software like this
Free during beta