CVE-2026-98810

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue()

ieee80211_monitor_select_queue() validates the skb length using skb->len

before dereferencing pointers into skb->data to access the 802.11 header.

However, skb->len includes data in both the linear head buffer and

non-linear fragments/pages. When AF_PACKET sends a packet large enough to

become non-linear, the 802.11 header at skb->data + len_rthdr may extend

past the linear head buffer even though skb->len appears sufficient.

This leads to a slab-out-of-bounds read when accessing hdr->frame_control,

as the kernel reads beyond the allocated skb head buffer:

BUG: KASAN: slab-out-of-bounds in ieee80211_monitor_select_queue+0x1ed/0x220

syzbot has hit the same issues.

Fix this by checking skb_headlen(skb) (which gives the length of the

linear data region) instead of skb->len before dereferencing skb->data

pointers. This ensures the required bytes are actually present in the

linear portion of the skb.

Apply the same fix to ieee80211_validate_radiotap_len() which has the

same class of bug: it uses skb->len to validate accesses to skb->data,

and to the corresponding checks in ieee80211_monitor_start_xmit(): for

drivers advertising NETIF_F_SG the skb is not linearized before

ndo_start_xmit, so the 802.11 header can be read past the linear

buffer there as well.