wifi: mac80211_hwsim: clamp virtio RX length before skb_put

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-68411
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-08-10 13:20:34 UTC
Updated2026-08-10 13:20:34 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: clamp virtio RX length before skb_put hwsim_virtio_rx_work() passes the virtqueue used-ring length reported by the device straight to skb_put() on a fixed-size receive skb. A backend reporting a length larger than the skb tailroom drives skb_put() past the buffer end and hits skb_over_panic() -- a host-triggerable guest panic (denial of service). Clamp the length to the skb's available room before skb_put(). A conforming device never reports more than the posted buffer size, so valid frames are unaffected; a truncated over-report then fails the length/header checks in hwsim_virtio_handle_cmd() and is dropped, so truncating rather than dropping here cannot be turned into a parsing problem.

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 5d44fe7c9808c56e136e59147bd932f5491520f1 82c5a30a66e2a7337d99476c67d6fc1a99c4250e git Not specified
CNA Linux Linux affected 5d44fe7c9808c56e136e59147bd932f5491520f1 fade308845c89f784da8a6780c1e77258488f1b6 git Not specified
CNA Linux Linux affected 5d44fe7c9808c56e136e59147bd932f5491520f1 6dc76371a9a360c29de00df5b11563102d9d675a git Not specified
CNA Linux Linux affected 5d44fe7c9808c56e136e59147bd932f5491520f1 99dc05c75acc3c8cde8d89c5371f4b569de5ac62 git Not specified
CNA Linux Linux affected 5d44fe7c9808c56e136e59147bd932f5491520f1 10a2b430f8f06ae14b9590b6f6faa6b588ef0654 git Not specified
CNA Linux Linux affected 5.7 Not specified
CNA Linux Linux unaffected 5.7 semver Not specified
CNA Linux Linux unaffected 6.6.148 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.101 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.42 6.18.* semver Not specified
CNA Linux Linux unaffected 7.1.6 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2-rc4 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/6dc76371a9a360c29de00df5b11563102d9d675a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/82c5a30a66e2a7337d99476c67d6fc1a99c4250e 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/10a2b430f8f06ae14b9590b6f6faa6b588ef0654 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/fade308845c89f784da8a6780c1e77258488f1b6 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/99dc05c75acc3c8cde8d89c5371f4b569de5ac62 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report