{"id":"CVE-2026-98810","kind":"vulnerability","aliases":["CVE-2026-98810"],"related":[],"title":"Linux kernel: mac80211 monitor mode reads past packet buffer","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue()\n\nieee80211_monitor_select_queue() validates the skb length using skb->len\nbefore dereferencing pointers into skb->data to access the 802.11 header.\nHowever, skb->len includes data in both the linear head buffer and\nnon-linear fragments/pages. When AF_PACKET sends a packet large enough to\nbecome non-linear, the 802.11 header at skb->data + len_rthdr may extend\npast the linear head buffer even though skb->len appears sufficient.\n\nThis leads to a slab-out-of-bounds read when accessing hdr->frame_control,\nas the kernel reads beyond the allocated skb head buffer:\n\n  BUG: KASAN: slab-out-of-bounds in ieee80211_monitor_select_queue+0x1ed/0x220\n\nsyzbot has hit the same issues.\n\nFix this by checking skb_headlen(skb) (which gives the length of the\nlinear data region) instead of skb->len before dereferencing skb->data\npointers. This ensures the required bytes are actually present in the\nlinear portion of the skb.\n\nApply the same fix to ieee80211_validate_radiotap_len() which has the\nsame class of bug: it uses skb->len to validate accesses to skb->data,\nand to the corresponding checks in ieee80211_monitor_start_xmit(): for\ndrivers advertising NETIF_F_SG the skb is not linearized before\nndo_start_xmit, so the 802.11 header can be read past the linear\nbuffer there as well.","summary":"A bounds check in the Linux kernel's mac80211 Wi-Fi monitor-mode code uses the total packet length instead of the linear buffer length, so a large AF_PACKET frame can cause an out-of-bounds read. The sources do not state what an attacker gains beyond a kernel memory read.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kernel","linux","mac80211","runtime","wifi"],"not_affected_if":["no-monitor-mode","no-wifi-hardware"],"how_to_check":"- Run `uname -r` and compare against the fixed kernel release in your distribution's advisory: unknown\n- Check whether the mac80211 module is loaded with `lsmod | grep mac80211`; unknown if the sources do not say more","fix":"- Update the Linux kernel to a release that includes the upstream fix for ieee80211_monitor_select_queue(): unknown exact version\n- Reboot after installing the kernel update","status":"open","published_at":"2026-10-18T16:17:35+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:14:54+00:00","updated_at":"2026-10-25T05:14:54+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:14:54Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix for ieee80211_monitor_select_queue(): unknown exact version\n- Reboot after installing the kernel update","reach":"local","title":"Linux kernel: mac80211 monitor mode reads past packet buffer","impact":"low","summary":"A bounds check in the Linux kernel's mac80211 Wi-Fi monitor-mode code uses the total packet length instead of the linear buffer length, so a large AF_PACKET frame can cause an out-of-bounds read. The sources do not state what an attacker gains beyond a kernel memory read.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","wifi","mac80211"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel memory read out of bounds; possible crash or leak","analyst_note":"Confirm affected kernel version ranges and the fixed stable release from the kernel git commit or distribution advisories; the NVD entry carries no CVSS score.","how_to_check":"- Run `uname -r` and compare against the fixed kernel release in your distribution's advisory: unknown\n- Check whether the mac80211 module is loaded with `lsmod | grep mac80211`; unknown if the sources do not say more","needs_analyst":true,"not_affected_if":["no-wifi-hardware","no-monitor-mode"],"who_is_affected":"Systems running a Linux kernel with mac80211 Wi-Fi support where monitor-mode interfaces are used and AF_PACKET sockets can send frames. The sources do not say which kernel versions are affected or how common the configuration is, so systems without Wi-Fi hardware or monitor interfaces are likely not exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000695,"input_tokens":3763,"output_tokens":637,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':209C '-2026':11A,14A '-98810':12A,15A '802.11':120C,152C,310C 'access':118C,183C,279C 'actual':248C 'advertis':295C 'af':51B,139C 'alloc':193C 'appear':170C 'appli':257C 'attack':69B 'becom':147C 'beyond':71B,191C 'bound':22B,60B,93C,180C,203C 'buffer':9A,46B,132C,165C,196C,318C 'bug':197C,272C 'byte':246C 'caus':55B 'check':23B,220C,287C 'class':270C 'code':36B 'control':186C 'correspond':286C 'cve':10A,13A 'data':116C,126C,156C,231C,240C,282C 'dereferenc':112C,238C 'driver':294C 'enough':145C 'ensur':243C 'even':166C 'extend':160C 'f':297C 'fi':32B 'fix':88C,217C,260C 'follow':81C 'fragments/pages':137C 'frame':53B,185C 'gain':70B 'give':225C 'hdr':184C 'head':131C,164C,195C 'header':121C,153C,311C 'headlen':222C 'hit':213C 'howev':122C 'ieee80211':96C,100C,205C,262C,289C 'includ':125C 'instead':42B,233C 'issu':216C 'kasan':198C 'kernel':2A,16B,27B,73B,79C,189C 'larg':50B,144C 'lead':173C 'len':110C,124C,157C,169C,236C,265C,276C 'length':41B,47B,107C,227C 'linear':45B,130C,136C,150C,163C,230C,252C,303C,317C 'linux':1A,17B,26B,78C 'mac80211':3A,18B,29B,87C 'may':159C 'memori':74B 'mode':5A,35B 'monitor':4A,34B,97C,101C,206C,290C 'monitor-mod':33B 'ndo':305C 'netif':296C 'non':135C,149C 'non-linear':134C,148C 'out-of-bound':57B 'packet':8A,40B,52B,140C,143C 'past':7A,161C,315C 'pointer':113C,241C 'portion':253C 'present':249C 'queue':99C,103C,208C 'radiotap':264C 'read':6A,61B,75B,94C,181C,190C,314C 'region':232C 'requir':245C 'resolv':85C 'rthdr':158C 'runtim':19B 'select':98C,102C,207C 'send':141C 'sg':298C 'skb':106C,109C,115C,123C,155C,168C,194C,221C,223C,235C,239C,256C,275C,281C,300C 'slab':90C,177C,200C 'slab-out-of-bound':89C,176C,199C 'sourc':63B 'start':291C,306C 'state':66B 'suffici':171C 'syzbot':211C 'though':167C 'total':39B 'use':37B,108C,274C 'valid':104C,263C,278C 'vulner':82C 'well':321C 'wi':31B 'wi-fi':30B 'wifi':20B,86C 'x1ed/0x220':210C 'xmit':292C,307C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with mac80211 Wi-Fi support where monitor-mode interfaces are used and AF_PACKET sockets can send frames. The sources do not say which kernel versions are affected or how common the configuration is, so systems without Wi-Fi hardware or monitor interfaces are likely not exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98810","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98810","severity":null,"published_at":"2026-10-18T16:17:35+00:00","modified_at":"2026-10-19T10:19:45+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}