In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: reject short monitor TX frames In monitor mode,… (CVE-2026-98890)

The Linux kernel's libertas wifi driver had a vulnerability in monitor mode where the lbs_hard_start_xmit() function cast skb->data to a radiotap TX header and then copied the 802.11 destination address from an offset without adequate length validation. The generic length check only rejected zero-length or oversized skbs, allowing short monitor frames to be read past the skb data boundary. The vulnerability was resolved by enforcing a length check that ensures the frame contains enough bytes for both the radiotap TX header and the destination address field before processing the monitor-mode header layout.

This vulnerability could lead to out-of-bounds memory reads when processing short monitor mode TX frames, which may cause kernel memory corruption or crashes. No information about exploitation in the wild or further impact is provided.

A fix has been implemented in the Linux kernel to reject short monitor TX frames by requiring sufficient length before accessing the radiotap TX header and destination address. Users should apply the official kernel update containing this fix once available. Patch status is not explicitly confirmed in the provided data; check the vendor advisory or Linux kernel mailing lists for the official patch and update guidance.