In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO… (CVE-2026-98887)

The Linux kernel's mac80211_hwsim module contained a vulnerability where the function hwsim_tx_info_frame_received_nl() cast the HWSIM_ATTR_TX_INFO payload to a struct hwsim_tx_rate pointer and unconditionally read IEEE80211_TX_MAX_RATES entries (8 bytes each). The attribute policy only enforced an upper bound on the payload length, and the operation disabled strict validation, allowing short or zero-length attributes to be accepted. This led to out-of-bounds reads past the payload buffer. The fix requires the attribute to have the exact expected length, rejecting malformed attributes before processing.

The vulnerability could cause out-of-bounds memory reads in the kernel, potentially leading to information disclosure or kernel instability. However, no known exploits in the wild have been reported. The impact is limited to the mac80211_hwsim wireless simulation component of the Linux kernel.

A fix is available that enforces exact length validation on the HWSIM_ATTR_TX_INFO attribute, preventing malformed attributes from being processed. Users should apply the official Linux kernel update that includes this patch to mitigate the vulnerability.