Live › vulnerability › CVE-2026-98890
Go to dashboardThe libertas Wi-Fi driver in the Linux kernel does not check that a monitor-mode transmit frame is long enough before reading its radiotap header and destination address. A short frame can cause the kernel to read memory beyond the end of the packet buffer.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only systems that load the libertas driver, which covers older Marvell 802.11 USB and SDIO Wi-Fi hardware, and that use monitor mode. Systems without that hardware or with the module absent are not exposed. The sources do not say which kernel versions are fixed.
No product ranges from the sources yet.
uname -r and compare against the fixed kernel versions in your distribution's advisorylsmod | grep libertasEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
wifi: libertas: reject short monitor TX frames
In monitor mode, lbs_hard_start_xmit() casts skb->data to a radiotap TX header, skips that header, and then copies the 802.11 destination address from offset 4 in the remaining frame. The generic length check only rejects zero-length and oversized skbs, so a short monitor frame can be read past the end of the skb data.
Require enough bytes for the radiotap TX header and the destination address field before using the monitor-mode header layout.
This page as .md · .json · in your agent: get_signal("CVE-2026-98890")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.