CVE-2026-98829

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: drop oversized fragments to avoid extra len overflow

In ieee80211 rx h defragment(), fragment payloads are accumulated into entry->extra len as subsequent fragments arrive:

entry->extra len += rx->skb->len;

When the final fragment arrives, the head fragment is dequeued, and pskb expand head() is called with entry->extra len to ensure sufficient tailroom for all queued fragments before copying:

if (skb tailroom(rx->skb) < entry->extra len) {
    if (unlikely(pskb expand head(rx->skb, 0, entry->extra len,
                   GFP ATOMIC))) {
        ...
    }
}
while ((skb =  skb dequeue(&entry->skb list))) {
    skb put data(rx->skb, skb->data, skb->len);
    dev kfree skb(skb);
}

In commit 69f132236827 ("mac80211: shrink struct ieee80211 fragment entry"), entry->extra len was narrowed from unsigned int to u16 in order to reduce structure memory footprint.

However, an IEEE 802.11 frame sequence can contain up to 16 fragments (frag numbers 0..15). If a sequence of large fragments arrives (e.g. from a malicious peer or rogue AP), the sum of fragment lengths can exceed 65535 bytes (for example, 15 fragments of 4400 bytes total 66000 bytes). Because extra len is a u16, this addition overflows and wraps around modulo 65536 (e.g. 66000 wraps to 464).

Consequently, pskb expand head() allocates only the truncated amount of tailroom (or is skipped entirely if the head fragment already has >= 464 bytes of tailroom). When skb put data() subsequently iterates through the queued skb list, it appends the full payload into the undersized buffer, causing skb put() to trigger skb over panic() and crash the kernel in softirq context.

A legitimate MSDU in IEEE 802.11 is at most 2304 bytes (or up to 7935/11454 bytes for A-MSDU, which is not fragmented), well below U16 MAX.

Fix this without increasing the size of struct ieee80211 fragment entry by checking whether adding the incoming fragment length would exceed U16 MAX. If so, purge the queued fragments and drop the frame.

[assign a separate drop reason]