Cloudanix VulnDB

CVE-2026-63869

High · 7.6

CVSS

7.6

EPSS

0.3%

Published

Jul 19, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in the Linux kernel's wireless code could let someone nearby send special network frames that make the system unstable or crash.

Exploitation
Adjacent Network
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Improper Input Validation
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

The flaw allows an 8-bit antenna index from a userspace-supplied radiotap header to be used directly as a shift count in BIT() on a 64-bit unsigned long, exceeding the 2-bit storage limit of the antennas field and triggering shift-out-of-bounds undefined behavior.

Why it matters to the business

Linux systems handling wireless monitor or injection traffic may experience kernel instability, crashes, or unpredictable behavior when processing crafted frames, increasing operational risk in wireless environments even though exploit maturity remains low.

How an attack unfolds

An attacker with the ability to inject 802.11 frames (via packet sockets or similar) supplies a radiotap header containing an IEEE80211_RADIOTAP_ANTENNA value greater than 1; ieee80211_parse_tx_radiotap then performs an oversized shift, hitting UBSAN-reported undefined behavior during frame transmission.

How to fix it

Update the Linux kernel to a version containing the limit check that discards antenna indices greater than 1 before the BIT() operation; apply the fix from the mac80211 tx.c change that enforces the 2-bit antenna constraint.

How to confirm the fix worked

Confirm the patched kernel source contains the added bounds check on iterator.this_arg before the BIT() assignment in ieee80211_parse_tx_radiotap; test by attempting injection of a radiotap frame with antenna index 2 or higher and verify absence of UBSAN reports.

Typical attack path

  1. Obtain capability to send raw 802.11 frames on a wireless interface (packet socket or monitor mode).
  2. Construct a radiotap header with IEEE80211_RADIOTAP_ANTENNA set to a value >= 2.
  3. Transmit the injected frame via the kernel's monitor transmit path.
  4. Trigger ieee80211_parse_tx_radiotap which performs the out-of-bounds shift.

How to detect it

Review kernel logs for UBSAN shift-out-of-bounds messages referencing net/mac80211/tx.c and ieee80211_parse_tx_radiotap; inspect wireless monitor interface usage and packet socket activity for unexpected frame injection.

What your security team should do

  • Prioritize kernel updates on systems exposing wireless monitor or injection interfaces.
  • Restrict raw packet injection privileges to only trusted processes and users.
  • Monitor for UBSAN shift-out-of-bounds reports in wireless transmit paths as an early indicator of exposure.

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap When parsing the radiotap header of an injected frame, ieee80211_parse_tx_radiotap() uses the IEEE80211_RADIOTAP_ANTENNA value directly as a shift count: info->control.antennas |= BIT(*iterator.this_arg); *iterator.this_arg is an 8-bit value taken straight from the frame supplied by userspace, so BIT() can be asked to shift by up to 255. That is undefined behaviour on the unsigned long and is reported by UBSAN: UBSAN: shift-out-of-bounds in net/mac80211/tx.c:2174:30 shift exponent 235 is too large for 64-bit type 'unsigned long' Call Trace: ieee80211_parse_tx_radiotap+0xadb/0x1950 net/mac80211/tx.c:2174 ieee80211_monitor_start_xmit+0xb1f/0x1250 net/mac80211/tx.c:2451 ... packet_sendmsg+0x3eb6/0x50f0 net/packet/af_packet.c:3109 info->control.antennas is a 2-bit bitmap (u8 antennas:2), so only antenna indices 0 and 1 can ever be represented. Ignore any larger value instead of shifting out of bounds.

Affected packages

Ecosystem Package Introduced Fixed