In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue()… (CVE-2026-98810)

The vulnerability in the Linux kernel's mac80211 wifi component involves an out-of-bounds read in ieee80211_monitor_select_queue(). The function validated skb length using skb->len, which counts both linear and non-linear fragments, but dereferenced pointers assuming the data was linear. When AF_PACKET sends a large enough packet to become non-linear, the 802.11 header access can exceed the linear buffer, causing slab-out-of-bounds reads and kernel memory corruption detected by KASAN. The fix replaces skb->len checks with skb_headlen(skb) to ensure pointer dereferences remain within the linear buffer. Similar corrections were made in ieee80211_validate_radiotap_len() and ieee80211_monitor_start_xmit() to address the same class of bug.

This vulnerability can cause slab-out-of-bounds reads in kernel memory, potentially leading to kernel crashes or memory corruption. However, no known exploits in the wild have been reported. The impact is primarily a stability and security risk within the kernel's wifi stack.

A fix has been applied to the Linux kernel to address this vulnerability by changing length validation from skb->len to skb_headlen(skb) in the affected functions. Users should update to the fixed Linux kernel versions once available. Since this is a kernel-level issue, applying the official kernel patch or upgrading to a patched kernel release is the recommended remediation.