Threats Tagged 'ghsa-8w97-qwf2-rgh5'

A vulnerability in the Linux kernel's mac80211 wireless subsystem allows oversized IEEE 802.11 fragments to cause an integer overflow in the fragment payload length accumulator. This overflow leads to insufficient buffer allocation and ultimately triggers a kernel crash in softirq context when processing fragmented frames. The issue arises because the fragment length sum is stored in a 16-bit unsigned integer, which can overflow when large fragments are received. The flaw has been fixed by adding a check to drop frames that would cause overflow without increasing memory footprint.