Live › vulnerability › CVE-2026-98887
Go to dashboardThe mac80211_hwsim wireless test driver in the Linux kernel trusts the length of a netlink attribute and reads eight-byte rate entries from it without checking the size. A short or empty attribute makes the read run past the buffer, which can crash the kernel or leak adjacent memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
The mac80211_hwsim module is a simulated wireless driver used for testing, so it is only present on systems that load it. Ordinary machines without that module loaded are unlikely to be affected. The sources do not say whether a non-root user can reach the netlink interface, so unknown.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO
hwsim_tx_info_frame_received_nl() casts the HWSIM_ATTR_TX_INFO payload to a struct hwsim_tx_rate * and unconditionally reads IEEE80211_TX_MAX_RATES entries (8 bytes) from it. The policy only bounds the attribute from above (NLA_BINARY .len is a maximum) and the op sets GENL_DONT_VALIDATE_STRICT, so a short or zero-length attribute is accepted and the loop reads past the payload.
Require the exact length in the policy, so a malformed attribute is rejected before the handler runs.
This page as .md · .json · in your agent: get_signal("CVE-2026-98887")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.