Cloudanix VulnDB

CVE-2026-23367

Medium · 5.5

CVSS

5.5

EPSS

0.1%

Published

Mar 25, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in how Linux handles certain wireless network packets could let a local user crash the system.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use of uninitialized iterator->next_ns_data value in the radiotap parser when undefined field 18 is encountered, leading to comparison against garbage data and potential kernel crash or undefined behavior during wireless frame processing.

Why it matters to the business

Local denial-of-service risk on Linux systems handling wireless traffic; low urgency given low EPSS and lack of known exploitation or ransomware use after 215 days.

How an attack unfolds

An attacker with local access crafts a radiotap frame containing unknown field 18, submits it through a wireless interface, and triggers the parser path that performs the uninitialized comparison, causing a kernel fault.

How to fix it

Apply the upstream kernel commit that moves unknown-field rejection after the namespace lookup; monitor stable kernel releases for backports once available.

How to confirm the fix worked

Confirm kernel source contains the reordered rejection logic; test parser with crafted frames containing field 18 and verify no uninitialized-value warnings or crashes occur.

Typical attack path

  1. Obtain local access or user privileges on target Linux system
  2. Craft radiotap frame with undefined field 18 set
  3. Inject frame via wireless interface or monitoring socket
  4. Trigger kernel radiotap parsing code path
  5. Induce crash or denial of service via uninitialized value use

How to detect it

Inspect kernel logs for radiotap-related oops or uninitialized-value warnings; correlate with wireless frame capture tools for malformed radiotap headers.

What your security team should do

  • Prioritize kernel updates for wireless-enabled systems once patches ship
  • Limit unprivileged access to raw wireless sockets and monitor mode
  • Review wireless driver configurations to reduce attack surface

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: radiotap: reject radiotap with unknown bits The radiotap parser is currently only used with the radiotap namespace (not with vendor namespaces), but if the undefined field 18 is used, the alignment/size is unknown as well. In this case, iterator->_next_ns_data isn't initialized (it's only set for skipping vendor namespaces), and syzbot points out that we later compare against this uninitialized value. Fix this by moving the rejection of unknown radiotap fields down to after the in-namespace lookup, so it will really use iterator->_next_ns_data only for vendor namespaces, even in case undefined fields are present.

Affected packages

Ecosystem Package Introduced Fixed