Cloudanix VulnDB

CVE-2026-68411

None

CVSS

—

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in the Linux kernel's wireless simulation driver lets a virtualization backend crash the entire guest operating system, causing sudden loss of service until the system is restarted.

Exploitation
Other
Attacker needs
High Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The hwsim_virtio_rx_work function passes an untrusted length value reported by a virtio device directly to skb_put on a fixed-size receive buffer; an oversized value advances the skb write pointer past its tailroom and triggers skb_over_panic, causing a kernel panic.

Why it matters to the business

A compromised or malicious virtualization backend can crash the guest kernel on demand, producing denial of service and unplanned downtime for any workloads that rely on mac80211_hwsim in a virtio environment.

How an attack unfolds

An attacker controlling the virtio backend (host or emulated device) supplies a receive-ring length larger than the guest's posted buffer size; the guest driver copies this value straight into skb_put without clamping, the kernel detects the overrun and panics, terminating the guest.

How to fix it

Apply the upstream fix that clamps the reported length to the skb's available tailroom before calling skb_put; rebuild and deploy the patched kernel on all affected systems.

How to confirm the fix worked

Confirm the presence of the clamping logic in hwsim_virtio_rx_work and verify that an oversized length no longer triggers skb_over_panic; test with a deliberately oversized ring entry to ensure the frame is dropped cleanly instead of panicking.

Typical attack path

  1. Attacker gains control of the virtio backend or emulates a malicious device
  2. Backend populates the used ring with a length exceeding the guest skb tailroom
  3. hwsim_virtio_rx_work reads the oversized length and calls skb_put without bounds checking
  4. Kernel hits skb_over_panic and initiates a guest panic

How to detect it

Review kernel crash dumps and logs for skb_over_panic or mac80211_hwsim stack traces; correlate virtio ring activity preceding the panic; no persistent artifacts remain after reboot.

What your security team should do

  • Prioritize patching systems that expose mac80211_hwsim over virtio, especially those reachable from untrusted hosts
  • Monitor for kernel panics containing skb_over_panic or mac80211_hwsim symbols
  • Restrict virtio device attachment to trusted backends where possible

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: clamp virtio RX length before skb_put hwsim_virtio_rx_work() passes the virtqueue used-ring length reported by the device straight to skb_put() on a fixed-size receive skb. A backend reporting a length larger than the skb tailroom drives skb_put() past the buffer end and hits skb_over_panic() -- a host-triggerable guest panic (denial of service). Clamp the length to the skb's available room before skb_put(). A conforming device never reports more than the posted buffer size, so valid frames are unaffected; a truncated over-report then fails the length/header checks in hwsim_virtio_handle_cmd() and is dropped, so truncating rather than dropping here cannot be turned into a parsing problem.

Affected packages

Ecosystem Package Introduced Fixed