CVE-2026-98887 in Linux
Summary
by MITRE • 10/23/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO
hwsim_tx_info_frame_received_nl() casts the HWSIM_ATTR_TX_INFO payload to a struct hwsim_tx_rate * and unconditionally reads IEEE80211_TX_MAX_RATES entries (8 bytes) from it. The policy only bounds the attribute from above (NLA_BINARY .len is a maximum) and the op sets GENL_DONT_VALIDATE_STRICT, so a short or zero-length attribute is accepted and the loop reads past the payload.
Require the exact length in the policy, so a malformed attribute is rejected before the handler runs.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/23/2026
The Linux kernel vulnerability identified within the mac80211_hwsim subsystem represents a critical out-of-bounds read condition arising from insufficient input validation of network attributes. Specifically, the function hwsim_tx_info_frame_received_nl processes data associated with the HWSIM_ATTR_TX_INFO attribute by casting its payload directly to a struct hwsim_tx_rate structure. This structural cast assumes that the incoming data contains at least enough bytes to populate all fields within the structure, particularly when iterating through IEEE80211_TX_MAX_RATES entries which require eight bytes of data per entry. The core technical flaw lies in the Generalized Netlink policy configuration for this attribute, where only an upper bound on length is enforced via NLA_BINARY len constraints rather than a strict minimum or exact length requirement. Furthermore, the operation flag GENL_DONT_VALIDATE_STRICT disables additional kernel-level validation checks that might otherwise catch malformed inputs before they reach the handler logic.
This combination of permissive policy settings and unchecked casting allows an attacker to supply a zero-length or undersized attribute payload. When such a short payload is received, the code proceeds unconditionally to read from memory locations beyond the actual end of the provided buffer. This results in reading arbitrary kernel memory contents into local variables used for transmission rate calculations. While this specific instance manifests as an out-of-bounds read rather than a write operation, it still poses significant security risks including information disclosure and potential denial of service if the accessed memory triggers page faults or corrupts subsequent processing logic based on garbage data retrieved from adjacent kernel structures.
From a threat modeling perspective, this vulnerability aligns with CWE-125 Out-of-bounds Read, as the application reads beyond allocated buffer boundaries due to missing bounds checking. In terms of adversary behavior within the MITRE ATT&CK framework for Linux systems, this flaw facilitates privilege escalation or reconnaissance by allowing local users who have access to the virtual WiFi interface to leak kernel memory contents. The exploitation vector typically requires local user privileges capable of sending netlink messages to the mac80211_hwsim subsystem, which is often available in containerized environments or multi-tenant systems where such interfaces are exposed.
The remediation strategy implemented addresses this flaw by enforcing an exact length requirement within the Netlink policy for HWSIM_ATTR_TX_INFO. By rejecting attributes that do not match the expected size precisely, the kernel ensures that only well-formed data reaches the handler function hwsim_tx_info_frame_received_nl. This preventive measure eliminates the possibility of undersized payloads being processed and prevents the subsequent out-of-bounds memory access. System administrators should apply this patch to affected Linux kernels immediately to mitigate the risk of information leakage through virtual WiFi interfaces, particularly in environments where untrusted users or containers interact with network simulation tools that utilize mac80211_hwsim features.