CVE-2026-63869 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap
When parsing the radiotap header of an injected frame, ieee80211_parse_tx_radiotap() uses the IEEE80211_RADIOTAP_ANTENNA value directly as a shift count:
info->control.antennas |= BIT(*iterator.this_arg);
*iterator.this_arg is an 8-bit value taken straight from the frame supplied by userspace, so BIT() can be asked to shift by up to 255. That is undefined behaviour on the unsigned long and is reported by UBSAN:
UBSAN: shift-out-of-bounds in net/mac80211/tx.c:2174:30 shift exponent 235 is too large for 64-bit type 'unsigned long' Call Trace: ieee80211_parse_tx_radiotap+0xadb/0x1950 net/mac80211/tx.c:2174 ieee80211_monitor_start_xmit+0xb1f/0x1250 net/mac80211/tx.c:2451 ... packet_sendmsg+0x3eb6/0x50f0 net/packet/af_packet.c:3109
info->control.antennas is a 2-bit bitmap (u8 antennas:2), so only antenna indices 0 and 1 can ever be represented. Ignore any larger value instead of shifting out of bounds.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability exists within the linux kernel's mac80211 subsystem where the ieee80211_parse_tx_radiotap() function processes radiotap headers from injected wireless frames. This function directly utilizes an 8-bit value extracted from userspace-provided frame data as a bit shift operand without proper validation. The specific issue occurs when the IEEE80211_RADIOTAP_ANTENNA field value is used to compute BIT(iterator.this_arg) where iterator.this_arg represents an unsigned 8-bit integer that can range from 0 to 255. When this value exceeds the valid antenna index range, it results in undefined behavior during bit manipulation operations on a 64-bit unsigned long type.
The technical flaw stems from insufficient input validation in the radiotap header parsing routine, creating a potential for out-of-bounds bit shifting operations that violate standard integer arithmetic rules. The system's handling of userspace-controlled data directly impacts kernel memory operations, as demonstrated by the undefined behavior reported by UBSAN (Undefined Behavior Sanitizer). This particular instance shows a shift exponent of 235 exceeding the bounds of a 64-bit unsigned long type, representing a classic case of improper input sanitization and validation within kernel space. The vulnerability manifests when the kernel attempts to perform bit operations with values that exceed the logical limits of the target data structure.
The operational impact of this vulnerability extends beyond simple memory corruption as it represents an entry point for potential privilege escalation or denial-of-service conditions within wireless networking subsystems. Attackers could exploit this by crafting malicious radiotap frames with oversized antenna index values, potentially causing kernel crashes, memory corruption, or enabling more sophisticated exploitation techniques. The vulnerability affects systems utilizing mac80211 wireless drivers and is particularly concerning in environments where untrusted userspace applications can inject wireless frames or when monitoring tools process user-supplied wireless data. Given that this operates within the kernel's wireless transmission path, successful exploitation could compromise network integrity and availability.
The recommended mitigation strategy involves implementing strict bounds checking on the antenna index value before performing bit manipulation operations. The fix should validate that any parsed antenna index falls within the acceptable range of 0-1 for the 2-bit bitmap structure, ignoring or clamping values outside this valid range rather than allowing undefined behavior. This approach aligns with security best practices for kernel input validation and follows established patterns for handling untrusted data in kernel space. The solution directly addresses the root cause by ensuring that BIT() operations only receive shift counts within the logical bounds of the target data type, preventing both the undefined behavior and potential exploitation vectors that could arise from out-of-bounds operations.
This vulnerability classification aligns with CWE-129: Improper Validation of Array Index and CWE-755: Improper Handling of Exceptional Conditions, while exhibiting characteristics consistent with ATT&CK technique T1068: Exploitation for Privilege Escalation and T1499.003: Endpoint Denial of Service. The issue demonstrates how improper input validation in kernel space can create pathways for both system instability and potential privilege escalation, emphasizing the critical importance of robust data sanitization in operating system components that handle user-supplied data.