{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98890", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.378Z", "datePublished": "2026-10-23T11:37:50.495Z", "dateUpdated": "2026-10-26T06:56:15.594Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-26T06:56:15.594Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: libertas: reject short monitor TX frames\n\nIn monitor mode, lbs_hard_start_xmit() casts skb->data to a\nradiotap TX header, skips that header, and then copies the 802.11\ndestination address from offset 4 in the remaining frame. The\ngeneric length check only rejects zero-length and oversized skbs, so\na short monitor frame can be read past the end of the skb data.\n\nRequire enough bytes for the radiotap TX header and the destination\naddress field before using the monitor-mode header layout."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/marvell/libertas/tx.c"], "versions": [{"version": "876c9d3aeb989cf1961f2c228d309ba5dcfb1172", "lessThan": "68c92c991ddb75dfd3fd62a94a1d4d2dde44dc3c", "status": "affected", "versionType": "git"}, {"version": "876c9d3aeb989cf1961f2c228d309ba5dcfb1172", "lessThan": "d865dd6de8295f2bfaa83f0f5d49d2bef1543065", "status": "affected", "versionType": "git"}, {"version": "876c9d3aeb989cf1961f2c228d309ba5dcfb1172", "lessThan": "6576baa3fdbaa91fa75e4ba27095f4b8a27349a8", "status": "affected", "versionType": "git"}, {"version": "876c9d3aeb989cf1961f2c228d309ba5dcfb1172", "lessThan": "b657cc98d7936c5d9ed7e0e1944ad0e1f36375bb", "status": "affected", "versionType": "git"}, {"version": "876c9d3aeb989cf1961f2c228d309ba5dcfb1172", "lessThan": "443fac3de65c76544b450b9f9903be8989150d55", "status": "affected", "versionType": "git"}, {"version": "876c9d3aeb989cf1961f2c228d309ba5dcfb1172", "lessThan": "cdcfd662c67833d89ee3d912efde2eb67c8a7326", "status": "affected", "versionType": "git"}, {"version": "876c9d3aeb989cf1961f2c228d309ba5dcfb1172", "lessThan": "13ff543e0b2c713aedeaadadde686686e949dc78", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/marvell/libertas/tx.c"], "versions": [{"version": "2.6.22", "status": "affected"}, {"version": "0", "lessThan": "2.6.22", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.22", "versionEndExcluding": "5.10.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.22", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.22", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.22", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.22", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.22", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.22", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/68c92c991ddb75dfd3fd62a94a1d4d2dde44dc3c"}, {"url": "https://git.kernel.org/stable/c/d865dd6de8295f2bfaa83f0f5d49d2bef1543065"}, {"url": "https://git.kernel.org/stable/c/6576baa3fdbaa91fa75e4ba27095f4b8a27349a8"}, {"url": "https://git.kernel.org/stable/c/b657cc98d7936c5d9ed7e0e1944ad0e1f36375bb"}, {"url": "https://git.kernel.org/stable/c/443fac3de65c76544b450b9f9903be8989150d55"}, {"url": "https://git.kernel.org/stable/c/cdcfd662c67833d89ee3d912efde2eb67c8a7326"}, {"url": "https://git.kernel.org/stable/c/13ff543e0b2c713aedeaadadde686686e949dc78"}], "title": "wifi: libertas: reject short monitor TX frames", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/wireless/marvell/libertas/tx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "68c92c991ddb75dfd3fd62a94a1d4d2dde44dc3c", "status": "affected", "version": "876c9d3aeb989cf1961f2c228d309ba5dcfb1172", "versionType": "git"}, {"lessThan": "d865dd6de8295f2bfaa83f0f5d49d2bef1543065", "status": "affected", "version": "876c9d3aeb989cf1961f2c228d309ba5dcfb1172", "versionType": "git"}, {"lessThan": "6576baa3fdbaa91fa75e4ba27095f4b8a27349a8", "status": "affected", "version": "876c9d3aeb989cf1961f2c228d309ba5dcfb1172", "versionType": "git"}, {"lessThan": "b657cc98d7936c5d9ed7e0e1944ad0e1f36375bb", "status": "affected", "version": "876c9d3aeb989cf1961f2c228d309ba5dcfb1172", "versionType": "git"}, {"lessThan": "443fac3de65c76544b450b9f9903be8989150d55", "status": "affected", "version": "876c9d3aeb989cf1961f2c228d309ba5dcfb1172", "versionType": "git"}, {"lessThan": "cdcfd662c67833d89ee3d912efde2eb67c8a7326", "status": "affected", "version": "876c9d3aeb989cf1961f2c228d309ba5dcfb1172", "versionType": "git"}, {"lessThan": "13ff543e0b2c713aedeaadadde686686e949dc78", "status": "affected", "version": "876c9d3aeb989cf1961f2c228d309ba5dcfb1172", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/wireless/marvell/libertas/tx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.22"}, {"lessThan": "2.6.22", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.271", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: libertas: reject short monitor TX frames\n\nIn monitor mode, lbs_hard_start_xmit() casts skb->data to a\nradiotap TX header, skips that header, and then copies the 802.11\ndestination address from offset 4 in the remaining frame. The\ngeneric length check only rejects zero-length and oversized skbs, so\na short monitor frame can be read past the end of the skb data.\n\nRequire enough bytes for the radiotap TX header and the destination\naddress field before using the monitor-mode header layout."}], "id": "CVE-2026-98890", "lastModified": "2026-10-26T07:17:14.153", "metrics": {}, "published": "2026-10-23T12:18:22.840", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/13ff543e0b2c713aedeaadadde686686e949dc78"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/443fac3de65c76544b450b9f9903be8989150d55"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6576baa3fdbaa91fa75e4ba27095f4b8a27349a8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/68c92c991ddb75dfd3fd62a94a1d4d2dde44dc3c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b657cc98d7936c5d9ed7e0e1944ad0e1f36375bb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cdcfd662c67833d89ee3d912efde2eb67c8a7326"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d865dd6de8295f2bfaa83f0f5d49d2bef1543065"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: wifi: libertas: reject short monitor TX frames", "id": "2559548", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559548"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nwifi: libertas: reject short monitor TX frames\nIn monitor mode, lbs_hard_start_xmit() casts skb->data to a\nradiotap TX header, skips that header, and then copies the 802.11\ndestination address from offset 4 in the remaining frame. The\ngeneric length check only rejects zero-length and oversized skbs, so\na short monitor frame can be read past the end of the skb data.\nRequire enough bytes for the radiotap TX header and the destination\naddress field before using the monitor-mode header layout.", "A flaw was found in the Linux kernel's Libertas wireless driver. When operating in monitor mode, the driver fails to properly validate the length of transmission frames before accessing header data. A local attacker could exploit this flaw by transmitting truncated monitor frames, triggering an out-of-bounds memory read that may lead to a system crash and Denial of Service (DoS) or the disclosure of kernel memory."], "name": "CVE-2026-98890", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98890\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98890\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98890.mbox"], "threat_severity": "Moderate"}