Cloudanix VulnDB

CVE-2026-98890

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A wireless driver in Linux could read beyond its allowed memory area when handling certain short test transmissions, which might cause crashes or leaks on affected devices.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Data Exposure
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds read in Linux kernel libertas wifi driver when processing short monitor-mode TX frames due to insufficient length validation before accessing radiotap header and 802.11 destination address.

Why it matters to the business

Potential kernel memory disclosure or crash on affected Linux systems using the libertas driver in monitor mode, leading to denial of service or limited information exposure; low exploitability reduces immediate widespread risk but requires prompt attention given recent publication.

How an attack unfolds

An attacker in monitor mode crafts a short TX frame lacking sufficient bytes after the radiotap header, causing lbs_hard_start_xmit to read past skb bounds when copying the destination address; no known threat actors or ransomware campaigns exploit this.

How to fix it

Update the Linux kernel to a version containing the fix that enforces minimum length checks for radiotap TX header plus destination address before monitor-mode processing; apply vendor-supplied patches promptly.

How to confirm the fix worked

Verify kernel source or binary contains the length validation before radiotap header access and destination address copy; test with crafted short monitor frames to confirm rejection.

Typical attack path

  1. Place wireless interface into monitor mode
  2. Transmit a deliberately short 802.11 frame with radiotap TX header
  3. Trigger lbs_hard_start_xmit processing with insufficient skb length
  4. Read kernel memory beyond skb data boundary

How to detect it

Monitor kernel logs for oops or panic messages referencing lbs_hard_start_xmit or libertas monitor TX; inspect skb handling paths for short-frame anomalies in wireless traffic captures.

What your security team should do

  • Assess exposure of any systems running libertas driver in monitor mode
  • Prioritize kernel updates within standard change windows given low EPSS and 2-day publication age
  • Disable monitor mode on unpatched systems if operationally feasible

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: reject short monitor TX frames In monitor mode, lbs_hard_start_xmit() casts skb->data to a radiotap TX header, skips that header, and then copies the 802.11 destination address from offset 4 in the remaining frame. The generic length check only rejects zero-length and oversized skbs, so a short monitor frame can be read past the end of the skb data. Require enough bytes for the radiotap TX header and the destination address field before using the monitor-mode header layout.

Affected packages

Ecosystem Package Introduced Fixed