A security update for the kernel-rt packages in Red Hat Enterprise Linux 8 addresses multiple vulnerabilities affecting the Real Time Linux Kernel. The fixes cover issues such as deferred resource release, validation of IPv6 extension headers, buffer overflows, integer overflows, and proper handling of graphics and wireless components. These vulnerabilities have been assigned CVEs and are rated as having an important security impact by Red Hat. The update requires a system reboot to take effect.
InjectEave is a side-channel eavesdropping attack that intercepts analog audio signals emitted by headphones and headsets. It exploits weak electromagnetic emissions generated by the analog components of headphones when converting digital audio to analog signals. By transmitting a radio signal at a specific frequency toward the target device, these emissions modulate the signal, allowing an attacker to intercept and reconstruct the original audio from several meters away. The attack has been demonstrated on multiple wireless and wired headphone models, with effective interception distances ranging from one to six meters. It can also capture two-way audio on wired telephone headsets. The attack requires physical proximity and tuning the transmitter frequency for each device, limiting its practicality. Unlike digital signal interception, this analog side-channel attack cannot be mitigated by encryption.
LibreNMS versions prior to 26.9.0 contain a stored cross-site scripting (XSS) vulnerability in the wireless.inc.php file. This vulnerability arises because wireless sensor description values obtained via SNMP are echoed into HTML without proper escaping. An attacker controlling a monitored device's SNMP agent can inject malicious JavaScript code that executes when authenticated users view the Wireless tab, potentially enabling session hijacking.
CVE-2026-102163 is a high-severity out-of-bounds write vulnerability (CWE-787) affecting Arista Networks Wi-Fi Access Points with Wireless Intrusion Prevention System (WIPS) enabled. An unauthenticated attacker within radio frequency proximity can send a crafted frame to crash the sensor service, disabling WIPS monitoring or potentially achieving remote code execution. No wireless association or authentication is required to exploit this vulnerability.
A vulnerability in the Linux kernel's mac80211 wireless subsystem involves improper offloading of traffic control (TC) setup on AP_VLAN interfaces, which are purely virtual. The kernel incorrectly attempts to offload TC setup to drivers on these interfaces, which is not appropriate. The issue has been resolved by rejecting TC offload on AP_VLAN interfaces so that processing occurs in software instead.
A vulnerability in the Linux kernel's mac80211 wireless subsystem allowed injection of frames with a requested bandwidth wider than the channel context. This could trigger warnings and potentially disrupt wireless operations. The issue has been resolved by dropping such frames entirely.
CVE-2026-98184 is a vulnerability in the Linux kernel's mwifiex wireless driver where improper handling of authentication frame length can lead to a heap buffer overflow. The flaw arises because the combined length of authentication data can exceed the maximum value storable in a 16-bit field, causing truncation and subsequent buffer overflow during data copy. Exploitation requires CAP_NET_ADMIN privileges and a suitable network environment. The issue has been resolved by validating length values before assignment.
A vulnerability in the Linux kernel's wifi cfg80211 subsystem caused a crash when attempting to get the radio mask for wireless devices without an associated network device. This was due to a null pointer dereference in the function cfg80211_calculate_bi_data() when calling rdev_get_radio_mask() with a null netdev pointer. The issue was fixed by changing the order of checks to ensure wdev->netdev is valid before use.
A vulnerability in the Linux kernel's mac80211 wireless subsystem caused the radio LED state and associated timer to remain active if bringing up the first wireless interface failed. This could lead to a timer being freed improperly, potentially causing kernel warnings or instability. The issue has been fixed by resetting the LED state on failure during interface initialization.
CVE-2026-98331 is a high-severity vulnerability in the Linux kernel's mac80211 wireless subsystem. It occurs because virtual interfaces (vifs) are not properly removed from the internal list when their associated network device (netdev) is unregistered under certain conditions, such as when the network namespace holding the wireless physical device (wiphy) is destroyed and fails to move to the initial namespace. This can lead to a kernel BUG triggered by referencing a non-existent interface. The issue has been fixed by ensuring the interface is removed from the list during netdev uninitialization if still present.
A use-after-free vulnerability was identified and fixed in the Linux kernel's wcn36xx wireless driver. The issue involves improper teardown of the TX acknowledgment timer, which could lead to a callback accessing freed memory. The fix replaces timer_delete() with timer_shutdown_sync() to ensure the callback completes before freeing resources.
CVE-2026-18417 is a memory-safety vulnerability in the Zephyr project's native BSD-socket layer affecting versions 4.3.0 up to but not including 4.4.2. The issue arises from improper handling of asynchronous socket errors by storing error codes in a field expected to hold a pointer, leading to wild-pointer dereferences during repeated network interface down events. This results in a kernel fatal error causing denial of service (device crash or reset) but does not allow attacker-controlled memory corruption. The vulnerability requires an attacker to repeatedly cause link-down events, such as disrupting a wireless link or having local/physical access. Later versions fix this by separating error storage from the user_data field and preventing stale error propagation.
RATHat is an Android banking trojan characterized by its unique architecture where the malicious application serves merely as an entry point. After obtaining Accessibility Service permissions, it enables wireless debugging, pairs with the device's ADB daemon, and deploys a native Go service that operates outside Android's permission model. The operation's primary investment lies in its infrastructure, with three successive Command-and-Control panel generations emerging between April and September 2026: BlackCat, followed by Panda Workshop V5 and V6. These panels function as complete malware factories, building, signing, and publishing samples automatically while implementing scheduled rebuilds to evade hash-based detection. Nearly 100 separate deployments across Europe, LATAM, and South-Eastern Asia suggest a Malware-as-a-Service model. Notably, the operation integrates AI on both sides: the malware uses Gemini models to locate on-screen controls when automation fails, while the panel employs LLMs to estim...
CVE-2026-100076 is a memory leak vulnerability in the Linux kernel's rtl8723bs wireless driver. It occurs due to improper handling of management transmit frames and buffers on certain error paths, leading to resource exhaustion. This can cause the interface to stop sending beacons or probe/association responses after repeated triggers.
A vulnerability in the Linux kernel's ath9k_htc wireless driver involved storing a usb_device_id that may not persist beyond the probe phase due to dynamic IDs. The issue was resolved by changing the code to store only driver_data, which is reliably accessible from the usb_device structure.
A race condition vulnerability in the Linux kernel's mac80211 wireless subsystem related to IBSS disconnect handling has been resolved. The issue occurs when packets can still be transmitted after the carrier is turned off due to cross-CPU race conditions, potentially causing drivers like iwlwifi to use invalid queues. The fix involves reordering operations and adding synchronization to prevent this race.
The Reachy Mini daemon exposes an HTTP API for managing the robot. Its app installation endpoint, POST /apps/install in src/reachy_mini/daemon/app/routers/apps.py, has no authentication. The handler's only dependency is Depends(get_app_manager), which just hands back the manager object from application state, so nothing in the chain ever checks a credential.
The endpoint takes an AppInfo body naming a Hugging Face Space. The daemon downloads that Space and installs it as a Python package through install_package in src/reachy_mini/apps/sources/local_common_venv.py, using uv or pip. Installing a Python package runs the package's own build and setup code, so whoever chooses the Space chooses what code the robot runs. Anyone can publish a public Hugging Face Space, so this is not a meaningful restriction on the attacker.
How far this reaches depends on the model. In _resolve_bind_host in src/reachy_mini/daemon/app/main.py the daemon binds 0.0.0.0 when it runs as the wireless version and 127.0.0.1 otherwise, with the vendor's own comment explaining that the robot has to be reachable on the LAN. On a wireless unit, then, any host on the same network can install and run code on the robot without credentials.
One related change has already shipped but does not fix this. Version 1.8.2 replaced the wildcard CORS policy with an allow list of localhost and Tauri origins. That closes the browser drive-by route, where a web page the victim visits silently calls the endpoint in the background. It has no effect on this issue: CORS is enforced by browsers and governs whether script may read a response, while a direct HTTP request from another machine on the network involves no browser, no preflight and no CORS check at all.
RatHat is a newly discovered Android malware that leverages AI to automate remote control of infected devices. It abuses Android Accessibility permissions to perform privileged actions, including enabling Developer Options and Wireless Debugging to gain shell-level access without external devices. RatHat installs a persistent Go-based agent that manages execution, persistence, and restoration of the malware and its components. It captures sensitive information such as banking credentials, SMS messages, one-time passwords, and lock-screen PINs via overlays and keylogging. The AI subsystem enables adaptive interface navigation by analyzing the live Accessibility tree and issuing dynamic commands, making detection and removal more difficult. The malware also employs anti-analysis and anti-removal techniques, including fake uninstall screens and obfuscation methods. Distribution occurs through malvertising, SMS, and phishing sites promoting APKs outside Google Play.
A use-after-free vulnerability in the Linux kernel's mt76 wireless driver (mt792x) has been resolved. The issue occurs due to a race condition where the STA (station) has been removed but the rx_status still references a pointer to the wcid in the STA, leading to invalid memory access. This vulnerability was fixed by setting the links' wcid pointers to NULL for a MLD in the mt7925_sta_pre_rcu_remove() function.