CVE-2026-98887

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO hwsim_tx_info_frame_received_nl() casts the HWSIM_ATTR_TX_INFO payload to a struct hwsim_tx_rate * and unconditionally reads IEEE80211_TX_MAX_RATES entries (8 bytes) from it. The policy only bounds the attribute from above (NLA_BINARY .len is a maximum) and the op sets GENL_DONT_VALIDATE_STRICT, so a short or zero-length attribute is accepted and the loop reads past the payload. Require the exact length in the policy, so a malformed attribute is rejected before the handler runs.

Package Linux Kernel
Published 2026-10-23
Last modified 2026-10-23
Patch available
Yes

Affected versions

Fixed in 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.111, 6.18.53, 7.2 and their respective stable series.

Fixed in
✓ 5.10.271 5.10.x ✓ 5.15.222 5.15.x ✓ 6.1.189 6.1.x ✓ 6.6.158 6.6.x ✓ 6.12.111 6.12.x ✓ 6.18.53 6.18.x ✓ 7.2

References

7 total
Showing 5 of 7 references View all on NVD

Frequently asked questions

  • What is CVE-2026-98887?

    CVE-2026-98887 is a unscored severity Linux kernel vulnerability . CVE-2026-98887 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

  • Is there a patch available for CVE-2026-98887?

    Yes. CVE-2026-98887 has been patched. Fixed versions include 5.10.271, 5.15.222, 6.1.189 and others.

  • Is CVE-2026-98887 actively exploited?

    No. CVE-2026-98887 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Back to
All CVEs
View on
NVD / NIST