---
id: CVE-2026-98810
title: >-
  wifi: mac80211: fix slab-out-of-bounds read in
  ieee80211_monitor_select_queue()
summary: >-
  In the Linux kernel, the following vulnerability has been resolved:


  wifi: mac80211: fix slab-out-of-bounds read in
  ieee80211_monitor_select_queue()


  ieee80211_monitor_select_queue() validates the skb length using skb->len

  before derefer…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 9b8a74e3482f9fc077a88c13fa0ceca8feb0b772 <
    63e7064b4c1c4b540bf2f0cba47384f92ab95307
  - >-
    Linux >= 9b8a74e3482f9fc077a88c13fa0ceca8feb0b772 <
    6f63e919fe1e335b8abcb3a28bfd4804a98d875a
  - Linux 2.6.24
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:48:56.733Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98810'
references:
  - url: 'https://git.kernel.org/stable/c/63e7064b4c1c4b540bf2f0cba47384f92ab95307'
  - url: 'https://git.kernel.org/stable/c/6f63e919fe1e335b8abcb3a28bfd4804a98d875a'
tags:
  - cve.org
ingestedAt: '2026-10-18T16:47:32.479Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue()

ieee80211_monitor_select_queue() validates the skb length using skb->len
before dereferencing pointers into skb->data to access the 802.11 header.
However, skb->len includes data in both the linear head buffer and
non-linear fragments/pages. When AF_PACKET sends a packet large enough to
become non-linear, the 802.11 header at skb->data + len_rthdr may extend
past the linear head buffer even though skb->len appears sufficient.

This leads to a slab-out-of-bounds read when accessing hdr->frame_control,
as the kernel reads beyond the allocated skb head buffer:

  BUG: KASAN: slab-out-of-bounds in ieee80211_monitor_select_queue+0x1ed/0x220

syzbot has hit the same issues.

Fix this by checking skb_headlen(skb) (which gives the length of the
linear data region) instead of skb->len before dereferencing skb->data
pointers. This ensures the required bytes are actually present in the
linear portion of the skb.

Apply the same fix to ieee80211_validate_radiotap_len() which has the
same class of bug: it uses skb->len to validate accesses to skb->data,
and to the corresponding checks in ieee80211_monitor_start_xmit(): for
drivers advertising NETIF_F_SG the skb is not linearized before
ndo_start_xmit, so the 802.11 header can be read past the linear
buffer there as well.

## Affected

- `Linux >= 9b8a74e3482f9fc077a88c13fa0ceca8feb0b772 < 63e7064b4c1c4b540bf2f0cba47384f92ab95307`
- `Linux >= 9b8a74e3482f9fc077a88c13fa0ceca8feb0b772 < 6f63e919fe1e335b8abcb3a28bfd4804a98d875a`
- `Linux 2.6.24`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.