CVE-2026-68411wifi: mac80211_hwsim: clamp virtio RX length before skb_put
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: clamp virtio RX length before skb_put hwsim_virtio_rx_work() passes the virtqueue used-ring length reported by the device straight to skb_put() on a fixed-size receive skb. A backend reporting a length larger than the skb tailroom drives skb_put() past the buffer end and hits skb_over_panic() -- a host-triggerable guest panic (denial of service). Clamp the length to the skb's available room before skb_put(). A conforming device never reports more than the posted buffer size, so valid frames are unaffected; a truncated over-report then fails the length/header checks in hwsim_virtio_handle_cmd() and is dropped, so truncating rather than dropping here cannot be turned into a parsing problem.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 5d44fe7c9808c56e136e59147bd932f5491520f1 before 7f9d678b870fca8eaf1d46fa915cba0b1d5b387a; from 5d44fe7c9808c56e136e59147bd932f5491520f1 before 909573d6a9b67354fc0515952574564e7c909c62; from 5d44fe7c9808c56e136e59147bd932f5491520f1 before 5779e4a33e1666ddfeba43e96e29c4a9e5254ff0; from 5d44fe7c9808c56e136e59147bd932f5491520f1 before 82c5a30a66e2a7337d99476c67d6fc1a99c4250e; from 5d44fe7c9808c56e136e59147bd932f5491520f1 before fade308845c89f784da8a6780c1e77258488f1b6; from 5d44fe7c9808c56e136e59147bd932f5491520f1 before 6dc76371a9a360c29de00df5b11563102d9d675a; from 5d44fe7c9808c56e136e59147bd932f5491520f1 before 99dc05c75acc3c8cde8d89c5371f4b569de5ac62; from 5d44fe7c9808c56e136e59147bd932f5491520f1 before 10a2b430f8f06ae14b9590b6f6faa6b588ef0654 | CNA record |
References
- https://git.kernel.org/stable/c/7f9d678b870fca8eaf1d46fa915cba0b1d5b387a
- https://git.kernel.org/stable/c/909573d6a9b67354fc0515952574564e7c909c62
- https://git.kernel.org/stable/c/5779e4a33e1666ddfeba43e96e29c4a9e5254ff0
- https://git.kernel.org/stable/c/82c5a30a66e2a7337d99476c67d6fc1a99c4250e
- https://git.kernel.org/stable/c/fade308845c89f784da8a6780c1e77258488f1b6
- https://git.kernel.org/stable/c/6dc76371a9a360c29de00df5b11563102d9d675a
- https://git.kernel.org/stable/c/99dc05c75acc3c8cde8d89c5371f4b569de5ac62
- https://git.kernel.org/stable/c/10a2b430f8f06ae14b9590b6f6faa6b588ef0654
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.