CVE-2026-63869

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ieee80211 parse tx radiotap() function when parsing the radiotap header of an injected frame. The function uses the IEEE80211 RADIOTAP ANTENNA value, which is an 8-bit value provided by userspace via the *iterator.this arg variable, directly as a shift count. This can result in a shift of up to 255, causing undefined behavior on the unsigned long type, as the info->control.antennas bitmap only supports indices 0 and 1.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.