Vulnerability feed

Executive summary

A flaw in the Linux kernel's mac80211_hwsim virtual wireless driver allows a malformed netlink message to be accepted and read past the end of its payload. The advisory does not state a severity rating or a CVSS score. The advisory describes a fix that rejects undersized attributes, and it does not state any workaround.

Technical summary

The weakness is an out-of-bounds read in hwsim_tx_info_frame_received_nl(), which casts the HWSIM_ATTR_TX_INFO payload to struct hwsim_tx_rate and reads IEEE80211_TX_MAX_RATES entries of 8 bytes each. The netlink policy only set a maximum length, and the operation sets GENL_DONT_VALIDATE_STRICT, so a short or zero-length attribute was accepted. The fix changes the policy to NLA_POLICY_EXACT_LEN so malformed attributes are rejected before the handler runs. The advisory does not state affected or fixed kernel version numbers, the attack vector beyond a local netlink message, required privileges, a CVSS score, or any detection guidance. The advisory references upstream commit 3dc723ac78a6e4fa0fd49e27e487ed319da40a9f.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from git.kernel.org/stable/c/13edd8ea7ff2ce6…290ef2034cd8cbed96c7

Score

No CVSS score published.

Affects

LinuxLinuxLinux kernelLinux mac80211_hwsim