CVE-2026-97511 in Linux
Summary
by MITRE • 09/24/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: avoid out-of-bounds access in monitor
In NAN, we don't know on what band the frame will be sent. Therefore we set info->band to NUM_NL80211_BANDS. However, this leads to out-of-bound access in ieee80211_add_tx_radiotap_header when we try to access the sbands array.
Fix it by not accessing the array if the band is NUM_NL80211_BANDS. This means that we will not report rate info for legacy rate in NAN. But nobody really cares about it.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified within the Linux kernel's mac80211 subsystem represents a critical out-of-bounds memory access issue specifically affecting Network Awareness Networking, commonly known as NAN functionality. This flaw originates from an improper handling of wireless band identifiers during the transmission process for monitor mode frames. In standard operation, the driver relies on specific band indices to map frame information into hardware-specific structures. However, within the context of NAN protocols, the exact frequency band upon which a frame will be transmitted is not deterministically known at the time certain data structures are initialized. To accommodate this uncertainty, the code previously set the info->band variable to NUM_NL80211_BANDS, a constant typically used as an upper bound or sentinel value rather than a valid array index.
This design choice leads directly to a buffer over-read when the ieee80211_add_tx_radiotap_header function attempts to access the sbands array using this invalid index. The sbands array contains pointers or data structures associated with specific wireless bands, and accessing it with an out-of-bounds value results in reading memory outside the allocated boundaries of that array. This constitutes a classic CWE-125: Out-of-bounds Read vulnerability. Depending on the surrounding memory layout and kernel state, such an access can lead to unpredictable behavior, including the leakage of sensitive kernel memory contents through monitor mode captures or potentially triggering a denial of service if the accessed address is unmapped or protected by hardware segmentation mechanisms.
The operational impact of this flaw extends beyond simple data corruption. Since mac80211 handles wireless frame processing for various interfaces, an attacker with local access to the system could potentially exploit this condition during NAN operations to extract kernel memory contents via radiotap headers captured in monitor mode. This aligns with ATT&CK technique T1005: Data from Local System, as it allows for the exfiltration of internal state information that is not intended for external observation. Furthermore, if the out-of-bounds read triggers a page fault or accesses invalid memory regions under specific conditions, it could cause a kernel panic, leading to a system crash and denial of service for all network-dependent applications running on the host.
The resolution implemented in this patch addresses the root cause by introducing a conditional check that prevents array access when the band identifier is set to NUM_NL80211_BANDS. By skipping the population of rate information fields associated with legacy rates during NAN transmissions, the code avoids triggering the out-of-bounds read entirely. While this results in a minor loss of diagnostic visibility regarding legacy transmission rates for NAN frames, it effectively neutralizes the security risk without compromising the core functionality of the network stack. This fix ensures that monitor mode captures remain safe and do not inadvertently expose kernel memory boundaries or cause instability due to invalid pointer dereferences.
To mitigate similar risks in broader software development practices, developers should strictly validate array indices against known bounds before access, particularly when dealing with dynamic values derived from protocol states where the exact parameter may be indeterminate. Implementing defensive programming techniques such as explicit range checks and using sentinel values only for control flow rather than direct indexing is essential to prevent CWE-125 vulnerabilities. For system administrators running affected Linux kernels, applying the latest security patches that include this mac80211 fix is critical to maintaining the integrity of wireless network operations and preventing potential information disclosure or service disruption through NAN-related traffic processing paths.