Executive brief
A vulnerability was identified in the Linux kernel's Wi-Fi driver framework (mac80211) that could lead to system instability. When a user-controlled application sends specially crafted wireless network data, it can trigger an 'undefined behavior' error in the system's memory handling. This could potentially be used to crash the system, affecting its availability.
Technical details
A shift-out-of-bounds vulnerability exists in the mac80211 stack within the ieee80211_parse_tx_radiotap function. The root cause is the lack of validation for the IEEE80211_RADIOTAP_ANTENNA value provided by userspace, which is used directly as a shift count for a BIT() macro. Since the target antennas field is only a 2-bit bitmap, providing a value larger than 1 (up to 255) results in undefined behavior. A local attacker with the ability to inject frames (e.g., via AF_PACKET) can trigger this UBSAN-reported error, potentially leading to a kernel panic or unpredictable system state. The issue has been resolved by adding a check to ensure the antenna index is less than 2.
Affected products
- Linux Linux Kernel 6.7 to 7.1
Timeline
- 2026-07-19: disclosed: Vulnerability disclosed and patched in various stable kernel branches.