AZL-110626: CVE-2026-98887 affecting package kernel 6.6.157.1-1

Q: Who can realistically trigger this issue?

An attacker needs to send a malformed generic netlink message targeting the mac80211_hwsim interface, with an undersized or empty HWSIM_ATTR_TX_INFO attribute. The provided data does not specify the required local privileges or whether unprivileged users can access this interface.

Q: What malformed input causes the out-of-bounds read?

The vulnerable handler accepts an HWSIM_ATTR_TX_INFO payload shorter than a struct hwsim_tx_rate and then unconditionally reads IEEE80211_TX_MAX_RATES entries from it. A zero-length attribute can also be accepted under the described validation behavior.

Q: How is the issue mitigated by the fix?

The fix requires HWSIM_ATTR_TX_INFO to have the exact expected length in the netlink policy. This rejects malformed attributes before they reach the handler and prevents the handler from reading beyond the supplied payload.

Published Oct 23, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211hwsim: reject undersized HWSIMATTRTXINFO

hwsimtxinfoframereceivednl() casts the HWSIMATTRTXINFO payload to a struct hwsimtxrate and unconditionally reads IEEE80211TXMAXRATES entries (8 bytes) from it. The policy only bounds the attribute from above (NLABINARY .len is a maximum) and the op sets GENLDONTVALIDATESTRICT, so a short or zero-length attribute is accepted and the loop reads past the payload.

Require the exact length in the policy, so a malformed attribute is rejected before the handler runs.

Affected Software

1 affected component

azure-linux/kernel<=6.6.157.1-1

Event History

Oct 23, 2026

Advisory Published

via OSV·12:18 PM

Data Sourced

via OSV·12:18 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-98887

Frequently Asked Questions

Who can realistically trigger this issue?

An attacker needs to send a malformed generic netlink message targeting the mac80211_hwsim interface, with an undersized or empty HWSIM_ATTR_TX_INFO attribute. The provided data does not specify the required local privileges or whether unprivileged users can access this interface.

What malformed input causes the out-of-bounds read?

The vulnerable handler accepts an HWSIM_ATTR_TX_INFO payload shorter than a struct hwsim_tx_rate and then unconditionally reads IEEE80211_TX_MAX_RATES entries from it. A zero-length attribute can also be accepted under the described validation behavior.

How is the issue mitigated by the fix?

The fix requires HWSIM_ATTR_TX_INFO to have the exact expected length in the netlink policy. This rejects malformed attributes before they reach the handler and prevents the handler from reading beyond the supplied payload.

AZL-110626: CVE-2026-98887 affecting package kernel 6.6.157.1-1

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

Who can realistically trigger this issue?

What malformed input causes the out-of-bounds read?

How is the issue mitigated by the fix?

Company

Resources

Contact

Frequently Asked Questions

Who can realistically trigger this issue?

What malformed input causes the out-of-bounds read?

How is the issue mitigated by the fix?