Cloudanix VulnDB

CVE-2026-98345

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in how the Linux kernel handles certain wireless network frames could cause crashes or unpredictable behavior when processing unusually short data.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Insufficient length validation of purported IP frames in cfg80211_classify8021d allows skb data shorter than an IP header to be dereferenced, producing an uninitialized-value read from the DS field.

Why it matters to the business

Wireless network traffic processing can trigger kernel instability or crashes on affected Linux systems, with low but non-zero exploitation probability that may affect device uptime and wireless connectivity reliability.

How an attack unfolds

An attacker crafts a short frame that passes initial checks as IP traffic and transmits it via a wireless interface; the kernel path through ieee80211_select_queue and cfg80211_classify8021d then reads past the actual data, surfacing the uninit-value.

How to fix it

Apply the kernel patch that replaces direct access with skb_header_pointer() in cfg80211_classify8021d (matching the MPLS handling); rebuild and deploy updated kernel images across affected distributions.

How to confirm the fix worked

Confirm the updated kernel source contains the skb_header_pointer call at net/wireless/util.c:1027; run KMSAN or syzkaller workloads that send short IP-like 802.11 frames and verify absence of the uninit-value report.

Typical attack path

  1. Transmit a malformed short frame appearing as IP over 802.11
  2. Kernel invokes ieee80211_subif_start_xmit and selects queue via cfg80211_classify8021d
  3. skb_header_pointer is not used, allowing out-of-bounds read of uninitialized memory
  4. KMSAN reports uninit-value or system exhibits undefined behavior

How to detect it

Search kernel logs and KMSAN reports for the exact stack trace containing cfg80211_classify8021d and ieee80211_select_queue; correlate with wireless interface packet reception timestamps.

  • BUG: KMSAN: uninit-value in cfg80211_classify8021d
  • cfg80211_classify8021d+0x99d/0x12b0 net/wireless/util.c:1027
  • ieee80211_select_queue+0x37a/0x9e0 net/mac80211/wme.c:180

What your security team should do

  • Prioritize kernel updates on wireless-enabled systems within standard patch windows given low EPSS and absence from KEV
  • Enable kernel memory sanitizers in test environments to catch similar uninit-value issues
  • Monitor upstream wireless and mac80211 commits for related length-check hardening

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: check IP header size in cfg80211_classify8021d() A frame that looks like IP can be transmitted, but be too short, so the DS field is read incorrectly: BUG: KMSAN: uninit-value in cfg80211_classify8021d+0x99d/0x12b0 net/wireless/util.c:1027 cfg80211_classify8021d+0x99d/0x12b0 net/wireless/util.c:1027 ieee80211_select_queue+0x37a/0x9e0 net/mac80211/wme.c:180 __ieee80211_subif_start_xmit+0x60f/0x1d90 net/mac80211/tx.c:4304 ieee80211_subif_start_xmit+0xa8/0x6d0 net/mac80211/tx.c:4538 ... packet_sendmsg+0x9173/0xa2a0 net/packet/af_packet.c:3108 Use skb_header_pointer() like the MPLS case.

Affected packages

Ecosystem Package Introduced Fixed