In the Linux kernel, the following vulnerability has been resolved:

wifi: rsi: validate beacon length before fixed buffer copy

rsi prepare beacon() copies the mac80211 beacon frame after FRAME DESC SZ into a management skb whose usable tailroom may be smaller than MAX MGMT PKT SIZE after alignment.

Validate the beacon length against the actual tailroom before the copy and skb put(). Leave ownership of the management skb with the caller on error, matching the existing rsi send beacon() cleanup path.