CVE-2026-68411 wifi: mac80211_hwsim: clamp virtio RX length before skb_put
A malicious virtio backend can cause a guest kernel panic by reporting an oversized RX length, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-68411?
CVE-2026-68411 is a denial of service vulnerability in Linux, published on 10 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211_hwsim: clamp virtio RX length before skb_put
hwsim_virtio_rx_work() passes the virtqueue used-ring length reported by the device straight to skb_put() on a fixed-size receive skb. A backend reporting a length larger than the skb tailroom drives skb_put() past the buffer end and hits skb_over_panic() -- a host-triggerable guest panic (denial of service).
Clamp the length to the skb's available room before skb_put(). A conforming device never reports more than the posted buffer size, so valid frames are unaffected; a truncated over-report then fails the length/header checks in hwsim_virtio_handle_cmd() and is dropped, so truncating rather than dropping here cannot be turned into a parsing problem.
Which versions are affected by CVE-2026-68411?
How do I fix CVE-2026-68411?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-68411 being exploited?
There is no known exploitation of CVE-2026-68411 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-68411, DEBIAN-CVE-2026-68411, GHSA-wpwp-37fg-5mf6, UBUNTU-CVE-2026-68411.