CVE-2026-98810

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue()

ieee80211_monitor_select_queue() validates the skb length using skb->len

before dereferencing pointers into skb->data to access the 802.11 header.

However, skb->len includes data in both the linear head buffer and

non-linear fragments/pages. When AF_PACKET sends a packet large enough to

become non-linear, the 802.11 header at skb->data + len_rthdr may extend

past the linear head buffer even though skb->len appears sufficient.

This leads to a slab-out-of-bounds read when accessing hdr->frame_control,

as the kernel reads beyond the allocated skb head buffer:

BUG: KASAN: slab-out-of-bounds in ieee80211_monitor_select_queue+0x1ed/0x220

syzbot has hit the same issues.

Fix this by checking skb_headlen(skb) (which gives the length of the

linear data region) instead of skb->len before dereferencing skb->data

pointers. This ensures the requi

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References