CVE-2026-98829

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: drop oversized fragments to avoid extra_len overflow

In ieee80211_rx_h_defragment(), fragment payloads are accumulated into

entry->extra_len as subsequent fragments arrive:

entry->extra_len += rx->skb->len;

When the final fragment arrives, the head fragment is dequeued, and

pskb_expand_head() is called with entry->extra_len to ensure sufficient

tailroom for all queued fragments before copying:

if (skb_tailroom(rx->skb) < entry->extra_len) {

if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,

GFP_ATOMIC))) {

...

}

}

while ((skb = __skb_dequeue(&entry->skb_list))) {

skb_put_data(rx->skb, skb->data, skb->len);

dev_kfree_skb(skb);

}

In commit 69f132236827 ("mac80211: shrink struct

ieee80211_fragment_entry"), entry->extra_l

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References