CVE-2026-68411

Summary

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211_hwsim: clamp virtio RX length before skb_put

hwsim_virtio_rx_work() passes the virtqueue used-ring length reported by the device straight to skb_put() on a fixed-size receive skb. A backend reporting a length larger than the skb tailroom drives skb_put() past the buffer end and hits skb_over_panic() – a host-triggerable guest panic (denial of service).

Clamp the length to the skb's available room before skb_put(). A conforming device never reports more than the posted buffer size, so valid frames are unaffected; a truncated over-report then fails the length/header checks in hwsim_virtio_handle_cmd() and is dropped, so truncating rather than dropping here cannot be turned into a parsing problem.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux5d44fe7c9808c56e136e59147bd932f5491520f1 < 82c5a30a66e2a7337d99476c67d6fc1a99c4250eaffected
LinuxLinux5d44fe7c9808c56e136e59147bd932f5491520f1 < fade308845c89f784da8a6780c1e77258488f1b6affected
LinuxLinux5d44fe7c9808c56e136e59147bd932f5491520f1 < 6dc76371a9a360c29de00df5b11563102d9d675aaffected
LinuxLinux5d44fe7c9808c56e136e59147bd932f5491520f1 < 99dc05c75acc3c8cde8d89c5371f4b569de5ac62affected
LinuxLinux5d44fe7c9808c56e136e59147bd932f5491520f1 < 10a2b430f8f06ae14b9590b6f6faa6b588ef0654affected
LinuxLinux5.7affected
LinuxLinux0 < 5.7unaffected
LinuxLinux6.6.148 <= 6.6.*unaffected
LinuxLinux6.12.101 <= 6.12.*unaffected
LinuxLinux6.18.42 <= 6.18.*unaffected
LinuxLinux7.1.6 <= 7.1.*unaffected
LinuxLinux7.2-rc4 <= *unaffected

Weaknesses

References