CVE-2026-98887: wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211hwsim: reject undersized HWSIMATTRTXINFO
hwsimtxinfoframereceivednl() casts the HWSIMATTRTXINFO payload to a struct hwsimtxrate and unconditionally reads IEEE80211TXMAXRATES entries (8 bytes) from it. The policy only bounds the attribute from above (NLABINARY .len is a maximum) and the op sets GENLDONTVALIDATESTRICT, so a short or zero-length attribute is accepted and the loop reads past the payload.
Require the exact length in the policy, so a malformed attribute is rejected before the handler runs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Require the HWSIM_ATTR_TX_INFO policy to enforce the exact expected payload length, rejecting undersized attributes before hwsim_tx_info_frame_received_nl() runs.
Linux kernel mac80211_hwsim HWSIM_ATTR_TX_INFO policy length = exact length