CVE-2026-98345

In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: check IP header size in cfg80211_classify8021d()

A frame that looks like IP can be transmitted, but be too short, so

the DS field is read incorrectly:

BUG: KMSAN: uninit-value in cfg80211_classify8021d+0x99d/0x12b0 net/wireless/util.c:1027

cfg80211_classify8021d+0x99d/0x12b0 net/wireless/util.c:1027

ieee80211_select_queue+0x37a/0x9e0 net/mac80211/wme.c:180

__ieee80211_subif_start_xmit+0x60f/0x1d90 net/mac80211/tx.c:4304

ieee80211_subif_start_xmit+0xa8/0x6d0 net/mac80211/tx.c:4538

...

packet_sendmsg+0x9173/0xa2a0 net/packet/af_packet.c:3108

Use skb_header_pointer() like the MPLS case.