{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-98810 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-98810 is a memory corruption vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-98810 and fix it if it is affected.\n\nWhat it is: CVE-2026-98810 is a memory corruption vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-98810 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-98810/ (Markdown: https://insights.sbomify.com/CVE-2026-98810/index.md)","id":"CVE-2026-98810","markdown":"https://insights.sbomify.com/CVE-2026-98810/index.md","name":"CVE-2026-98810","record":{"aliases":["AZL-108641","BELL-CVE-2026-98810","DEBIAN-CVE-2026-98810","GHSA-8wg2-h9c3-q8hh","UBUNTU-CVE-2026-98810"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service","data_read"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel WiFi","requires_auth":"low_privilege","summary":"A local attacker can trigger a slab-out-of-bounds read in the Linux kernel WiFi subsystem, potentially causing a crash or leaking memory.","user_interaction":"not_required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue()\n\nieee80211_monitor_select_queue() validates the skb length using skb-\u003elen\nbefore dereferencing pointers into skb-\u003edata to access the 802.11 header.\nHowever, skb-\u003elen includes data in both the linear head buffer and\nnon-linear fragments/pages. When AF_PACKET sends a packet large enough to\nbecome non-linear, the 802.11 header at skb-\u003edata + len_rthdr may extend\npast the linear head buffer even though skb-\u003elen appears sufficient.\n\nThis leads to a slab-out-of-bounds read when accessing hdr-\u003eframe_control,\nas the kernel reads beyond the allocated skb head buffer:\n\n  BUG: KASAN: slab-out-of-bounds in ieee80211_monitor_select_queue+0x1ed/0x220\n\nsyzbot has hit the same issues.\n\nFix this by checking skb_headlen(skb) (which gives the length of the\nlinear data region) instead of skb-\u003elen before dereferencing skb-\u003edata\npointers. This ensures the required bytes are actually present in the\nlinear portion of the skb.\n\nApply the same fix to ieee80211_validate_radiotap_len() which has the\nsame class of bug: it uses skb-\u003elen to validate accesses to skb-\u003edata,\nand to the corresponding checks in ieee80211_monitor_start_xmit(): for\ndrivers advertising NETIF_F_SG the skb is not linearized before\nndo_start_xmit, so the 802.11 header can be read past the linear\nbuffer there as well.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue()","id":"CVE-2026-98810","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"memory_corruption","year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"net/sched: cls_api: reclaim an empty proto on the error path","id":"CVE-2026-98811"},"packages":[],"prev":{"headline":"Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister","id":"CVE-2026-98809"},"products":["Linux"],"published":"2026-10-18","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A local attacker can trigger a slab-out-of-bounds read in the Linux kernel WiFi subsystem, potentially causing a crash or leaking memory.","url":"https://insights.sbomify.com/CVE-2026-98810/"}