CVE-2026-98890

In monitor mode, lbs_hard_start_xmit() casts skb->data to a radiotap TX header, skips that header, and then copies the 802.11 destination address from offset 4 in the remaining frame. The generic length check only rejects zero-length and oversized skbs, so a short monitor frame can be read past the end of the skb data.

Require enough bytes for the radiotap TX header and the destination address field before using the monitor-mode header layout.

Database specific

{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98890.json"
}

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

876c9d3aeb989cf1961f2c228d309ba5dcfb1172

Fixed

68c92c991ddb75dfd3fd62a94a1d4d2dde44dc3c

Fixed

d865dd6de8295f2bfaa83f0f5d49d2bef1543065

Fixed

6576baa3fdbaa91fa75e4ba27095f4b8a27349a8

Fixed

b657cc98d7936c5d9ed7e0e1944ad0e1f36375bb

Fixed

443fac3de65c76544b450b9f9903be8989150d55

Fixed

cdcfd662c67833d89ee3d912efde2eb67c8a7326

Fixed

13ff543e0b2c713aedeaadadde686686e949dc78

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-98890.json"

Linux / Kernel

Package

Name: Kernel

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.6.22

Fixed

5.10.271

Type: ECOSYSTEM
Events: Introduced

5.11.0

Fixed

5.15.222

Type: ECOSYSTEM
Events: Introduced

5.16.0

Fixed

6.1.189

Type: ECOSYSTEM
Events: Introduced

6.2.0

Fixed

6.6.158

Type: ECOSYSTEM
Events: Introduced

6.7.0

Fixed

6.12.111

Type: ECOSYSTEM
Events: Introduced

6.13.0

Fixed

6.18.53

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-98890.json"