In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drop oversized fragments to avoid extra_len overflow In… (CVE-2026-98829)

The vulnerability exists in the ieee80211_rx_h_defragment() function of the Linux kernel's mac80211 subsystem. Fragment payload lengths are accumulated into a 16-bit unsigned integer (entry->extra_len). Since an IEEE 802.11 frame can contain up to 16 fragments, the sum of fragment lengths can exceed 65535 bytes, causing an overflow and wraparound of entry->extra_len. This results in pskb_expand_head() allocating insufficient tailroom or skipping allocation, leading to skb_put() appending data beyond buffer limits and triggering skb_over_panic(), which crashes the kernel in softirq context. The fix involves detecting potential overflow before accumulation and dropping the frame if overflow would occur, avoiding increasing the size of the fragment entry structure.

Exploitation of this vulnerability can cause a denial of service by crashing the Linux kernel when processing maliciously crafted fragmented IEEE 802.11 frames. This crash occurs in softirq context, potentially disrupting wireless networking functionality and system stability. There is no indication of code execution or privilege escalation from the provided data.

A fix is available that adds a check to prevent overflow of the fragment length accumulator by dropping oversized fragments. Users should apply the official Linux kernel patch that implements this check. Since this is a kernel vulnerability, updating to a patched kernel version is the recommended remediation. No other mitigation actions are specified or required.