CVE-2026-68411

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211_hwsim: clamp virtio RX length before skb_put

hwsim_virtio_rx_work() passes the virtqueue used-ring length reported by

the device straight to skb_put() on a fixed-size receive skb. A backend

reporting a length larger than the skb tailroom drives skb_put() past the

buffer end and hits skb_over_panic() -- a host-triggerable guest panic

(denial of service).

Clamp the length to the skb's available room before skb_put(). A

conforming device never reports more than the posted buffer size, so valid

frames are unaffected; a truncated over-report then fails the

length/header checks in hwsim_virtio_handle_cmd() and is dropped, so

truncating rather than dropping here cannot be turned into a parsing

problem.