CVE-2026-68411

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211hwsim: clamp virtio RX length before skbput

hwsimvirtiorxwork() passes the virtqueue used-ring length reported by the device straight to skbput() on a fixed-size receive skb. A backend reporting a length larger than the skb tailroom drives skbput() past the buffer end and hits skbover_panic() -- a host-triggerable guest panic (denial of service).

Clamp the length to the skb's available room before skbput(). A conforming device never reports more than the posted buffer size, so valid frames are unaffected; a truncated over-report then fails the length/header checks in hwsimvirtiohandlecmd() and is dropped, so truncating rather than dropping here cannot be turned into a parsing problem.