Към съдържанието
Търсене

CVE-2026-98348: Linux

7.1

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се от съседна мрежа, без особени условия, без вход и без действие от потребителя.

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short association responses libipw_handle_assoc_resp() reads the capability, status and aid fields of the 30-byte association response prefix and then computes the information element length as stats->len - sizeof(*frame) stats->len is a u16 and sizeof() has type size_t, so the subtraction is evaluated as size_t and wraps instead of going negative. Truncating that to the u16 length parameter of libipw_parse_info_param() turns a frame shorter than the fixed fields into a length near 64 KiB, and the parser then reads past the receive buffer. Both the ipw2100 and ipw2200 management receive paths reach this function having established only that the frame carries the generic 24-byte three-address header. Reject the frame before any fixed field is touched. Found by an AI-assisted review of length arithmetic in management frame parsers. Verified with a KUnit case under Generic KASAN on arm64 under QEMU; I do not have the hardware, so it is not tested on a real device.

    Засегнати продукти

    • Linux Linux: 9e8571affd1c54b9638b4ff9844e47aae07310f6 преди 766268b429ae26d8ca599031fa962b0fe4673120; 9e8571affd1c54b9638b4ff9844e47aae07310f6 преди d70bdb84cf1782039384c1ffa7a18b0303c286a7; 9e8571affd1c54b9638b4ff9844e47aae07310f6 преди 400b89217058fac672134a0d4092c8493dadb8ad; 9e8571affd1c54b9638b4ff9844e47aae07310f6 преди 46aa75291056b6dc5faaf956dffdb3e9662477b0; 9e8571affd1c54b9638b4ff9844e47aae07310f6 преди e3025ecdb2057f866c09e059fc1466e81d6f243e; 9e8571affd1c54b9638b4ff9844e47aae07310f6 преди 14cb425ba1f3a5d849e3bbc3d02d84e0ae195dbb; 9e8571affd1c54b9638b4ff9844e47aae07310f6 преди af1b69be19c34e28c0ae54bee954b58cd076969a; 9e8571affd1c54b9638b4ff9844e47aae07310f6 преди adb7118b7d2cfd7e8213c17d7d2829f353017754
    • Linux Linux: 2.6.15; преди 2.6.15; 5.10.271 до 5.10.*; 5.15.222 до 5.15.*; 6.1.189 до 6.1.*; 6.6.158 до 6.6.*; 6.12.112 до 6.12.*; 6.18.54 до 6.18.*; 7.2.8 до 7.2.*; от 7.3 нататък

    История

    • 6 октомври 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-98348: Linux | freedomonline.bg