CVE-2026-98810

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: fix slab-out-of-bounds read in ieee80211 monitor select queue()

ieee80211 monitor select queue() validates the skb length using skb->len before dereferencing pointers into skb->data to access the 802.11 header. However, skb->len includes data in both the linear head buffer and non-linear fragments/pages. When AF PACKET sends a packet large enough to become non-linear, the 802.11 header at skb->data + len rthdr may extend past the linear head buffer even though skb->len appears sufficient.

This leads to a slab-out-of-bounds read when accessing hdr->frame control, as the kernel reads beyond the allocated skb head buffer:

BUG: KASAN: slab-out-of-bounds in ieee80211 monitor select queue+0x1ed/0x220

syzbot has hit the same issues.

Fix this by checking skb headlen(skb) (which gives the length of the linear data region) instead of skb->len before dereferencing skb->data pointers. This ensures the required bytes are actually present in the linear portion of the skb.

Apply the same fix to ieee80211 validate radiotap len() which has the same class of bug: it uses skb->len to validate accesses to skb->data, and to the corresponding checks in ieee80211 monitor start xmit(): for drivers advertising NETIF F SG the skb is not linearized before ndo start xmit, so the 802.11 header can be read past the linear buffer there as well.