« Volver al listado

CVE-2026-68411

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211_hwsim: clamp virtio RX length before skb_put

hwsim_virtio_rx_work() passes the virtqueue used-ring length reported by the device straight to skb_put() on a fixed-size receive skb. A backend reporting a length larger than the skb tailroom drives skb_put() past the buffer end and hits skb_over_panic() -- a host-triggerable guest panic (denial of service).

Clamp the length to the skb's available room before skb_put(). A conforming device never reports more than the posted buffer size, so valid frames are unaffected; a truncated over-report then fails the length/header checks in hwsim_virtio_handle_cmd() and is dropped, so truncating rather than dropping here cannot be turned into a parsing problem.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-68411",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5d44fe7c9808c56e136e59147bd932f5491520f1",
              "lessThan": "7f9d678b870fca8eaf1d46fa915cba0b1d5b387a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5d44fe7c9808c56e136e59147bd932f5491520f1",
              "lessThan": "909573d6a9b67354fc0515952574564e7c909c62",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5d44fe7c9808c56e136e59147bd932f5491520f1",
              "lessThan": "5779e4a33e1666ddfeba43e96e29c4a9e5254ff0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5d44fe7c9808c56e136e59147bd932f5491520f1",
              "lessThan": "82c5a30a66e2a7337d99476c67d6fc1a99c4250e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5d44fe7c9808c56e136e59147bd932f5491520f1",
              "lessThan": "fade308845c89f784da8a6780c1e77258488f1b6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5d44fe7c9808c56e136e59147bd932f5491520f1",
              "lessThan": "6dc76371a9a360c29de00df5b11563102d9d675a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5d44fe7c9808c56e136e59147bd932f5491520f1",
              "lessThan": "99dc05c75acc3c8cde8d89c5371f4b569de5ac62",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5d44fe7c9808c56e136e59147bd932f5491520f1",
              "lessThan": "10a2b430f8f06ae14b9590b6f6faa6b588ef0654",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/net/wireless/virtual/mac80211_hwsim_main.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.7",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/net/wireless/virtual/mac80211_hwsim_main.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-10T13:20:34.787",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/10a2b430f8f06ae14b9590b6f6faa6b588ef0654",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5779e4a33e1666ddfeba43e96e29c4a9e5254ff0",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6dc76371a9a360c29de00df5b11563102d9d675a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7f9d678b870fca8eaf1d46fa915cba0b1d5b387a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/82c5a30a66e2a7337d99476c67d6fc1a99c4250e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/909573d6a9b67354fc0515952574564e7c909c62",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/99dc05c75acc3c8cde8d89c5371f4b569de5ac62",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/fade308845c89f784da8a6780c1e77258488f1b6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211_hwsim: clamp virtio RX length before skb_put\n\nhwsim_virtio_rx_work() passes the virtqueue used-ring length reported by\nthe device straight to skb_put() on a fixed-size receive skb. A backend\nreporting a length larger than the skb tailroom drives skb_put() past the\nbuffer end and hits skb_over_panic() -- a host-triggerable guest panic\n(denial of service).\n\nClamp the length to the skb's available room before skb_put(). A\nconforming device never reports more than the posted buffer size, so valid\nframes are unaffected; a truncated over-report then fails the\nlength/header checks in hwsim_virtio_handle_cmd() and is dropped, so\ntruncating rather than dropping here cannot be turned into a parsing\nproblem."
    }
  ],
  "lastModified": "2026-08-19T17:20:48.810",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}