Cloudanix VulnDB

CVE-2026-98887

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in the Linux kernel's wireless testing component can let a local user read outside intended memory areas, which might crash the system or leak data.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Data Exposure
Component
OS kernel
Class
Buffer Overflow
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds read in hwsim_tx_info_frame_received_nl() due to unconditional access of IEEE80211_TX_MAX_RATES entries from an undersized HWSIM_ATTR_TX_INFO netlink attribute when GENL_DONT_VALIDATE_STRICT is set and only an upper bound exists in policy.

Why it matters to the business

Potential kernel memory disclosure or crash on systems using mac80211_hwsim for wireless testing or simulation, increasing operational risk for developers and embedded wireless environments until patched.

How an attack unfolds

An attacker with local access crafts a netlink message containing a short or zero-length HWSIM_ATTR_TX_INFO attribute and sends it to the mac80211_hwsim generic netlink family, causing the handler to read beyond the supplied buffer.

How to fix it

Update the Linux kernel to a version containing the fix that enforces exact length validation for HWSIM_ATTR_TX_INFO in the policy definition; rebuild and reboot affected systems or apply the stable backport when available.

How to confirm the fix worked

Confirm the kernel source contains the policy change requiring NLA_EXACT_LEN for HWSIM_ATTR_TX_INFO, then verify the module no longer accepts undersized attributes via targeted netlink fuzzing or unit tests.

Typical attack path

  1. Obtain local access on a Linux system with mac80211_hwsim loaded
  2. Create a netlink socket to the nl80211/mac80211_hwsim family
  3. Construct a malformed HWSIM_CMD_TX_INFO_FRAME message with undersized HWSIM_ATTR_TX_INFO
  4. Send the message to trigger the unconditional read loop
  5. Observe kernel oops, panic, or leaked data in the resulting crash or response

How to detect it

Review kernel logs for oops or panic messages referencing hwsim_tx_info_frame_received_nl or mac80211_hwsim; inspect audit logs for unexpected netlink activity targeting the hwsim family from untrusted processes.

What your security team should do

  • Prioritize kernel updates on any system exposing mac80211_hwsim interfaces
  • Restrict unprivileged local access to netlink generic families until patched
  • Monitor for new stable kernel releases containing this fix given the two-day publication window

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO hwsim_tx_info_frame_received_nl() casts the HWSIM_ATTR_TX_INFO payload to a struct hwsim_tx_rate * and unconditionally reads IEEE80211_TX_MAX_RATES entries (8 bytes) from it. The policy only bounds the attribute from above (NLA_BINARY .len is a maximum) and the op sets GENL_DONT_VALIDATE_STRICT, so a short or zero-length attribute is accepted and the loop reads past the payload. Require the exact length in the policy, so a malformed attribute is rejected before the handler runs.

Affected packages

Ecosystem Package Introduced Fixed