CVE-2026-98890 - Vulnerability Details

- wifi: libertas: reject short monitor TX frames

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: libertas: reject short monitor TX frames

In monitor mode, lbs_hard_start_xmit() casts skb->data to a
radiotap TX header, skips that header, and then copies the 802.11
destination address from offset 4 in the remaining frame. The
generic length check only rejects zero-length and oversized skbs, so
a short monitor frame can be read past the end of the skb data.

Require enough bytes for the radiotap TX header and the destination
address field before using the monitor-mode header layout.

Published: 2026-10-23

Score: n/a

EPSS: n/a

KEV: No

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 68c92c991ddb75dfd3fd62a94a1d4d2dde44dc3c
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< d865dd6de8295f2bfaa83f0f5d49d2bef1543065
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 6576baa3fdbaa91fa75e4ba27095f4b8a27349a8
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< b657cc98d7936c5d9ed7e0e1944ad0e1f36375bb
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 443fac3de65c76544b450b9f9903be8989150d55
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< cdcfd662c67833d89ee3d912efde2eb67c8a7326
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 13ff543e0b2c713aedeaadadde686686e949dc78
`0`	affected	< 5.10.271
`0`	affected	< 5.15.222
`0`	affected	< 6.1.189
`0`	affected	< 6.6.158
`0`	affected	< 6.12.111
`0`	affected	< 6.18.53

Linux

affected

Version	Status	Constraints
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.111`	unaffected	≤ 6.12.*
`6.18.53`	unaffected	≤ 6.18.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

100%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,68c92c991ddb75dfd3fd62a94a1d4d2dde44dc3c)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,d865dd6de8295f2bfaa83f0f5d49d2bef1543065)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,6576baa3fdbaa91fa75e4ba27095f4b8a27349a8)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,b657cc98b7936c5d9ed7e0e1944ad0e1f36375bb)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,443fac3de65c76544b450b9f9903be8989150d55)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,cdcfd662c67833d89ee3d912efde2eb67c8a7326)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,13ff543e0b2c713aedeaadadde686686e949dc78)`	affected	code_commit	—
`[0,5.10.271)`	affected	semver	—
`[0,5.15.222)`	affected	semver	—
`[0,6.1.189)`	affected	semver	—
`[0,6.6.158)`	affected	semver	—
`[0,6.12.111)`	affected	semver	—
`[0,6.18.53)`	affected	semver	—

Linux

100%

Version	Status	Scheme	Platform
`[5.10.271,5.10.*]`	unaffected	generic	—
`[5.15.222,5.15.*]`	unaffected	generic	—
`[6.1.189,6.1.*]`	unaffected	generic	—
`[6.6.158,6.6.*]`	unaffected	generic	—
`[6.12.111,6.12.*]`	unaffected	generic	—
`[6.18.53,6.18.*]`	unaffected	generic	—
`[7.2,*]`	unaffected	generic	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,68c92c991ddb75dfd3fd62a94a1d4d2dde44dc3c)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,d865dd6de8295f2bfaa83f0f5d49d2bef1543065)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,6576baa3fdbaa91fa75e4ba27095f4b8a27349a8)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,b657cc98b7936c5d9ed7e0e1944ad0e1f36375bb)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,443fac3de65c76544b450b9f9903be8989150d55)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,cdcfd662c67833d89ee3d912efde2eb67c8a7326)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,13ff543e0b2c713aedeaadadde686686e949dc78)`	affected	code_commit	—
`[0,5.10.271)`	affected	semver	—
`[0,5.15.222)`	affected	semver	—
`[0,6.1.189)`	affected	semver	—
`[0,6.6.158)`	affected	semver	—
`[0,6.12.111)`	affected	semver	—
`[0,6.18.53)`	affected	semver	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[5.10.271,5.10.*]`	unaffected	generic	—
`[5.15.222,5.15.*]`	unaffected	generic	—
`[6.1.189,6.1.*]`	unaffected	generic	—
`[6.6.158,6.6.*]`	unaffected	generic	—
`[6.12.111,6.12.*]`	unaffected	generic	—
`[6.18.53,6.18.*]`	unaffected	generic	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/13ff543e0b2c713aedeaadadde686686e949dc78
https://git.kernel.org/stable/c/443fac3de65c76544b450b9f9903be8989150d55
https://git.kernel.org/stable/c/6576baa3fdbaa91fa75e4ba27095f4b8a27349a8
https://git.kernel.org/stable/c/68c92c991ddb75dfd3fd62a94a1d4d2dde44dc3c
https://git.kernel.org/stable/c/b657cc98d7936c5d9ed7e0e1944ad0e1f36375bb
https://git.kernel.org/stable/c/cdcfd662c67833d89ee3d912efde2eb67c8a7326
https://git.kernel.org/stable/c/d865dd6de8295f2bfaa83f0f5d49d2bef1543065

History

Fri, 23 Oct 2026 18:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-20

Fri, 23 Oct 2026 17:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Fri, 23 Oct 2026 12:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: reject short monitor TX frames In monitor mode, lbs_hard_start_xmit() casts skb->data to a radiotap TX header, skips that header, and then copies the 802.11 destination address from offset 4 in the remaining frame. The generic length check only rejects zero-length and oversized skbs, so a short monitor frame can be read past the end of the skb data. Require enough bytes for the radiotap TX header and the destination address field before using the monitor-mode header layout.
Title		wifi: libertas: reject short monitor TX frames
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/13ff543e0b2c713aedeaadadde686686e949dc78 https://git.kernel.org/stable/c/443fac3de65c76544b450b9f9903be8989150d55 https://git.kernel.org/stable/c/6576baa3fdbaa91fa75e4ba27095f4b8a27349a8 https://git.kernel.org/stable/c/68c92c991ddb75dfd3fd62a94a1d4d2dde44dc3c https://git.kernel.org/stable/c/b657cc98d7936c5d9ed7e0e1944ad0e1f36375bb https://git.kernel.org/stable/c/cdcfd662c67833d89ee3d912efde2eb67c8a7326 https://git.kernel.org/stable/c/d865dd6de8295f2bfaa83f0f5d49d2bef1543065

Subscriptions

Linux Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-23T11:37:50.495Z

Updated: 2026-10-23T11:37:50.495Z

Reserved: 2026-09-25T10:25:14.378Z

Link: CVE-2026-98890

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-23T12:18:22.840

Modified: 2026-10-23T12:18:22.840

Link: CVE-2026-98890

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-10-23T17:45:17Z

Weaknesses

CWE-20
Improper Input Validation

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object