CVE-2026-98890
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: reject short monitor TX frames In monitor mode, lbs_hard_start_xmit() casts skb->data to a radiotap TX header, skips that header, and then copies the 802.11 destination address from offset 4 in the remaining frame. The generic length check only rejects zero-length and oversized skbs, so a short monitor frame can be read past the end of the skb data. Require enough bytes for the radiotap TX header and the destination address field before using the monitor-mode header layout.
Severity
Not scored
CVSS score
Not available
Vulnerability status
Received
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-10-23 12:18:22.840000
Last modified
2026-10-26 07:17:14.153000
View original CVE JSON
{
"id": "CVE-2026-98890",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-10-23T12:18:22.840",
"lastModified": "2026-10-26T07:17:14.153",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: libertas: reject short monitor TX frames\n\nIn monitor mode, lbs_hard_start_xmit() casts skb->data to a\nradiotap TX header, skips that header, and then copies the 802.11\ndestination address from offset 4 in the remaining frame. The\ngeneric length check only rejects zero-length and oversized skbs, so\na short monitor frame can be read past the end of the skb data.\n\nRequire enough bytes for the radiotap TX header and the destination\naddress field before using the monitor-mode header layout."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/net/wireless/marvell/libertas/tx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "876c9d3aeb989cf1961f2c228d309ba5dcfb1172",
"lessThan": "68c92c991ddb75dfd3fd62a94a1d4d2dde44dc3c",
"versionType": "git",
"status": "affected"
},
{
"version": "876c9d3aeb989cf1961f2c228d309ba5dcfb1172",
"lessThan": "d865dd6de8295f2bfaa83f0f5d49d2bef1543065",
"versionType": "git",
"status": "affected"
},
{
"version": "876c9d3aeb989cf1961f2c228d309ba5dcfb1172",
"lessThan": "6576baa3fdbaa91fa75e4ba27095f4b8a27349a8",
"versionType": "git",
"status": "affected"
},
{
"version": "876c9d3aeb989cf1961f2c228d309ba5dcfb1172",
"lessThan": "b657cc98d7936c5d9ed7e0e1944ad0e1f36375bb",
"versionType": "git",
"status": "affected"
},
{
"version": "876c9d3aeb989cf1961f2c228d309ba5dcfb1172",
"lessThan": "443fac3de65c76544b450b9f9903be8989150d55",
"versionType": "git",
"status": "affected"
},
{
"version": "876c9d3aeb989cf1961f2c228d309ba5dcfb1172",
"lessThan": "cdcfd662c67833d89ee3d912efde2eb67c8a7326",
"versionType": "git",
"status": "affected"
},
{
"version": "876c9d3aeb989cf1961f2c228d309ba5dcfb1172",
"lessThan": "13ff543e0b2c713aedeaadadde686686e949dc78",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/net/wireless/marvell/libertas/tx.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "2.6.22",
"status": "affected"
},
{
"version": "0",
"lessThan": "2.6.22",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.271",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.222",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.189",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.158",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.111",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.53",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.2",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/13ff543e0b2c713aedeaadadde686686e949dc78",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/443fac3de65c76544b450b9f9903be8989150d55",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6576baa3fdbaa91fa75e4ba27095f4b8a27349a8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/68c92c991ddb75dfd3fd62a94a1d4d2dde44dc3c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b657cc98d7936c5d9ed7e0e1944ad0e1f36375bb",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/cdcfd662c67833d89ee3d912efde2eb67c8a7326",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d865dd6de8295f2bfaa83f0f5d49d2bef1543065",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}