CVE-2026-98183: wifi: mac80211: avoid out-of-bounds read for empty PREQ elements
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: avoid out-of-bounds read for empty PREQ elements
ieee80211meshpreqsizeok() derives the location of the PREQ bottom fields before checking whether the element contains even the fixed header. ieee80211meshhwmppreqgetbottom() reads the flags byte to account for the optional Address Extension field. Consequently, an empty PREQ element causes a one-byte read beyond its declared payload.
Move the helper call after both size checks, so the bottom fields are only accessed when they are present.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the Linux kernel's mac80211 mesh functionality that process PREQ elements are exposed. The triggering condition is an empty PREQ element.
What does an attacker need to do to trigger the flaw?
An attacker needs to cause mac80211 to process a PREQ element with an empty declared payload. Processing that element causes a one-byte read beyond the payload before its fixed header size is validated.
How can I determine whether a system is affected?
Check whether the kernel includes either referenced stable fix commit: 3beddbd56946577478fd5e649f556aaaebe15b0a or e6031f02269c0f51cf67886d177f02bc300b47cd. A kernel containing the change that moves the PREQ bottom-field helper call until after both size checks is not affected.