{"id":"CVE-2026-98890","kind":"vulnerability","aliases":["CVE-2026-98890"],"related":[],"title":"Linux kernel: libertas Wi-Fi driver reads past short monitor-mode frames","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: libertas: reject short monitor TX frames\n\nIn monitor mode, lbs_hard_start_xmit() casts skb->data to a\nradiotap TX header, skips that header, and then copies the 802.11\ndestination address from offset 4 in the remaining frame.  The\ngeneric length check only rejects zero-length and oversized skbs, so\na short monitor frame can be read past the end of the skb data.\n\nRequire enough bytes for the radiotap TX header and the destination\naddress field before using the monitor-mode header layout.","summary":"The libertas Wi-Fi driver in the Linux kernel does not check that a monitor-mode transmit frame is long enough before reading its radiotap header and destination address. A short frame can cause the kernel to read memory beyond the end of the packet buffer.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kernel","libertas","linux","wifi"],"not_affected_if":["module-not-loaded","no-libertas-hardware"],"how_to_check":"- Run `uname -r` and compare against the fixed kernel versions in your distribution's advisory\n- Check whether the driver is loaded with `lsmod | grep libertas`\n- unknown for other checks","fix":"- Update the Linux kernel to a release that includes the upstream fix 'wifi: libertas: reject short monitor TX frames'\n- If the libertas driver is not needed, unload it or blacklist it\n- unknown for exact fixed versions","status":"open","published_at":"2026-10-23T12:18:22+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T05:00:02+00:00","updated_at":"2026-10-25T05:00:02+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:00:02Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix 'wifi: libertas: reject short monitor TX frames'\n- If the libertas driver is not needed, unload it or blacklist it\n- unknown for exact fixed versions","reach":"local","title":"Linux kernel: libertas Wi-Fi driver reads past short monitor-mode frames","impact":"low","summary":"The libertas Wi-Fi driver in the Linux kernel does not check that a monitor-mode transmit frame is long enough before reading its radiotap header and destination address. A short frame can cause the kernel to read memory beyond the end of the packet buffer.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","wifi","libertas"],"confidence":0.5,"needs_auth":"unknown","worst_case":"out-of-bounds kernel memory read from a short monitor frame","analyst_note":"Confirm fixed kernel versions and whether the bug is reachable without privileges, using the NVD entry and the upstream kernel commit.","how_to_check":"- Run `uname -r` and compare against the fixed kernel versions in your distribution's advisory\n- Check whether the driver is loaded with `lsmod | grep libertas`\n- unknown for other checks","needs_analyst":true,"not_affected_if":["no-libertas-hardware","module-not-loaded"],"who_is_affected":"Only systems that load the libertas driver, which covers older Marvell 802.11 USB and SDIO Wi-Fi hardware, and that use monitor mode. Systems without that hardware or with the module absent are not exposed. The sources do not say which kernel versions are fixed.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000648,"input_tokens":3405,"output_tokens":616,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-98890':17A,20A '4':118C '802.11':113C 'address':56B,115C,161C 'beyond':67B 'buffer':73B 'byte':152C 'cast':98C 'caus':61B 'check':38B,126C 'copi':111C 'cve':15A,18A 'data':100C,149C 'destin':55B,114C,160C 'driver':7A,31B 'end':69B,145C 'enough':48B,151C 'fi':6A,30B 'field':162C 'follow':79C 'frame':14A,45B,59B,90C,122C,139C 'generic':124C 'hard':95C 'header':53B,105C,108C,157C,169C 'infrastructur':21B 'kernel':2A,22B,35B,63B,77C 'layout':170C 'lbs':94C 'length':125C,131C 'liberta':3A,23B,27B,85C 'linux':1A,24B,34B,76C 'long':47B 'memori':66B 'mode':13A,43B,93C,168C 'monitor':12A,42B,88C,92C,138C,167C 'monitor-mod':11A,41B,166C 'offset':117C 'overs':133C 'packet':72B 'past':9A,143C 'radiotap':52B,103C,155C 'read':8A,50B,65B,142C 'reject':86C,128C 'remain':121C 'requir':150C 'resolv':83C 'short':10A,58B,87C,137C 'skb':99C,148C 'skbs':134C 'skip':106C 'start':96C 'transmit':44B 'tx':89C,104C,156C 'use':164C 'vulner':80C 'wi':5A,29B 'wi-fi':4A,28B 'wifi':25B,84C 'xmit':97C 'zero':130C 'zero-length':129C","nicknames":[],"mitigations":[],"who_affected":"Only systems that load the libertas driver, which covers older Marvell 802.11 USB and SDIO Wi-Fi hardware, and that use monitor mode. Systems without that hardware or with the module absent are not exposed. The sources do not say which kernel versions are fixed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T12:18:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98890","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98890","severity":null,"published_at":"2026-10-23T12:18:22+00:00","modified_at":"2026-10-23T12:18:22+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}