HIGH Introduced in 6.18
mac80211 Radiotap OOB
CVE-2026-97511
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: avoid out-of-bounds access in monitor In NAN, we don't know on what band the frame will be sent. Therefore we set info->band to NUM_NL80211_BANDS. However, this leads to out-of-bound access in ieee80211_add_tx_radiotap_header when we try to access the sbands array. Fix it by not accessing the array if the band is NUM_NL80211_BANDS. This means that we will not report rate info for legacy rate in NAN. But nobody really cares about it.
02KernelScan AI Analysis
Risk summary
A nearby WiFi attacker can trigger an out-of-bounds array read in the mac80211 transmit status path by causing a device with NAN active and a monitor interface to transmit NAN frames. The resulting pointer dereference can crash the kernel or expose a small amount of unintended memory, with no direct integrity impact.
Vulnerability analysis
When a WiFi device transmits NAN (Neighborhood Aware Networking) frames, the radio band is unknown, so the kernel records a sentinel value for the band. During transmit status processing for monitor interfaces, that sentinel value is used as an array index to look up legacy rate information, reading one element past the end of the band table and dereferencing the resulting pointer. This can crash the kernel or expose a small amount of unintended memory. The fix checks for the sentinel value before indexing the array and simply skips legacy rate reporting for NAN frames, which is acceptable since that information is not meaningful for NAN. A nearby attacker within WiFi range can trigger this by participating in NAN discovery, provided the target device has WiFi enabled with NAN active and a monitor interface configured; a local user with network administration privileges can also reach the same code path.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.18 | 6.18 | 6.18.53 | 7f087f70e020 |
| mainline | 6.18 | 7.2 | 03c41203ee5a |