{"id":"CVE-2026-98887","kind":"vulnerability","aliases":["CVE-2026-98887"],"related":[],"title":"Linux kernel: short mac80211_hwsim netlink attribute is read past its end","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO\n\nhwsim_tx_info_frame_received_nl() casts the HWSIM_ATTR_TX_INFO payload\nto a struct hwsim_tx_rate * and unconditionally reads\nIEEE80211_TX_MAX_RATES entries (8 bytes) from it. The policy only bounds\nthe attribute from above (NLA_BINARY .len is a maximum) and the op sets\nGENL_DONT_VALIDATE_STRICT, so a short or zero-length attribute is\naccepted and the loop reads past the payload.\n\nRequire the exact length in the policy, so a malformed attribute is\nrejected before the handler runs.","summary":"The mac80211_hwsim wireless test driver in the Linux kernel trusts the length of a netlink attribute and reads eight-byte rate entries from it without checking the size. A short or empty attribute makes the read run past the buffer, which can crash the kernel or leak adjacent memory.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","mac80211-hwsim","runtime","wifi"],"not_affected_if":["default-config","module-not-loaded"],"how_to_check":"- unknown","fix":"- Update to a Linux kernel release that includes the upstream commit rejecting undersized HWSIM_ATTR_TX_INFO; the sources do not list the fixed version numbers.","status":"open","published_at":"2026-10-23T12:18:22+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T05:00:05+00:00","updated_at":"2026-10-25T05:00:05+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:00:05Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the upstream commit rejecting undersized HWSIM_ATTR_TX_INFO; the sources do not list the fixed version numbers.","reach":"local","title":"Linux kernel: short mac80211_hwsim netlink attribute is read past its end","impact":"medium","summary":"The mac80211_hwsim wireless test driver in the Linux kernel trusts the length of a netlink attribute and reads eight-byte rate entries from it without checking the size. A short or empty attribute makes the read run past the buffer, which can crash the kernel or leak adjacent memory.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","wifi","mac80211-hwsim"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel memory is read out of bounds, possibly crashing the system","analyst_note":"Check the NVD entry and the upstream kernel commit to confirm the fixed kernel versions and whether unprivileged users can send the netlink message.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["module-not-loaded","default-config"],"who_is_affected":"The mac80211_hwsim module is a simulated wireless driver used for testing, so it is only present on systems that load it. Ordinary machines without that module loaded are unlikely to be affected. The sources do not say whether a non-root user can reach the netlink interface, so unknown.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000618,"input_tokens":3484,"output_tokens":539,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98887':15A,18A '8':124C 'accept':159C 'adjac':76B 'attr':94C,106C 'attribut':7A,43B,61B,133C,157C,177C 'binari':137C 'bound':131C 'buffer':68B 'byte':48B,125C 'cast':103C 'check':54B 'crash':71B 'cve':13A,16A 'dont':147C 'driver':32B 'eight':47B 'eight-byt':46B 'empti':60B 'end':12A 'entri':50B,123C 'exact':169C 'follow':83C 'frame':100C 'genl':146C 'handler':182C 'hwsim':5A,24B,29B,90C,93C,97C,105C,113C 'ieee80211':119C 'info':96C,99C,108C 'kernel':2A,21B,36B,73B,81C 'leak':75B 'len':138C 'length':39B,156C,170C 'linux':1A,20B,35B,80C 'linux-kernel':19B 'loop':162C 'mac80211':4A,23B,28B,89C 'mac80211-hwsim':22B 'make':62B 'malform':176C 'max':121C 'maximum':141C 'memori':77B 'netlink':6A,42B 'nl':102C 'nla':136C 'op':144C 'past':10A,66B,164C 'payload':109C,166C 'polici':129C,173C 'rate':49B,115C,122C 'read':9A,45B,64B,118C,163C 'receiv':101C 'reject':91C,179C 'requir':167C 'resolv':87C 'run':65B,183C 'runtim':25B 'set':145C 'short':3A,58B,152C 'size':56B 'strict':149C 'struct':112C 'test':31B 'trust':37B 'tx':95C,98C,107C,114C,120C 'uncondit':117C 'unders':92C 'valid':148C 'vulner':84C 'wifi':26B,88C 'wireless':30B 'without':53B 'zero':155C 'zero-length':154C","nicknames":[],"mitigations":[],"who_affected":"The mac80211_hwsim module is a simulated wireless driver used for testing, so it is only present on systems that load it. Ordinary machines without that module loaded are unlikely to be affected. The sources do not say whether a non-root user can reach the netlink interface, so unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T12:18:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98887","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98887","severity":null,"published_at":"2026-10-23T12:18:22+00:00","modified_at":"2026-10-23T12:18:22+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}