CVE-2026-97511

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97511", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-24T16:01:01.151Z", "datePublished": "2026-09-24T16:05:08.371Z", "dateUpdated": "2026-09-28T05:30:47.250Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-28T05:30:47.250Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: avoid out-of-bounds access in monitor\n\nIn NAN, we don't know on what band the frame will be sent. Therefore we\nset info->band to NUM_NL80211_BANDS. However, this leads to out-of-bound\naccess in ieee80211_add_tx_radiotap_header when we try to access the\nsbands array.\n\nFix it by not accessing the array if the band is NUM_NL80211_BANDS.\nThis means that we will not report rate info for legacy rate in NAN.\nBut nobody really cares about it."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mac80211/status.c"], "versions": [{"version": "fc41f4a28ac4d462487903229494eeb266f68a40", "lessThan": "7f087f70e020b16a5b967332ee6e937817eaa173", "status": "affected", "versionType": "git"}, {"version": "fc41f4a28ac4d462487903229494eeb266f68a40", "lessThan": "03c41203ee5a833a9d7a7630be190830cede29d8", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mac80211/status.c"], "versions": [{"version": "6.18", "status": "affected"}, {"version": "0", "lessThan": "6.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/7f087f70e020b16a5b967332ee6e937817eaa173"}, {"url": "https://git.kernel.org/stable/c/03c41203ee5a833a9d7a7630be190830cede29d8"}], "title": "wifi: mac80211: avoid out-of-bounds access in monitor", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/mac80211/status.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "7f087f70e020b16a5b967332ee6e937817eaa173", "status": "affected", "version": "fc41f4a28ac4d462487903229494eeb266f68a40", "versionType": "git"}, {"lessThan": "03c41203ee5a833a9d7a7630be190830cede29d8", "status": "affected", "version": "fc41f4a28ac4d462487903229494eeb266f68a40", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/mac80211/status.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.18"}, {"lessThan": "6.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: avoid out-of-bounds access in monitor\n\nIn NAN, we don't know on what band the frame will be sent. Therefore we\nset info->band to NUM_NL80211_BANDS. However, this leads to out-of-bound\naccess in ieee80211_add_tx_radiotap_header when we try to access the\nsbands array.\n\nFix it by not accessing the array if the band is NUM_NL80211_BANDS.\nThis means that we will not report rate info for legacy rate in NAN.\nBut nobody really cares about it."}], "id": "CVE-2026-97511", "lastModified": "2026-09-28T06:16:37.117", "metrics": {}, "published": "2026-09-24T17:17:28.993", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/03c41203ee5a833a9d7a7630be190830cede29d8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7f087f70e020b16a5b967332ee6e937817eaa173"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: wifi: mac80211: avoid out-of-bounds access in monitor", "id": "2540394", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540394"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nwifi: mac80211: avoid out-of-bounds access in monitor\nIn NAN, we don't know on what band the frame will be sent. Therefore we\nset info->band to NUM_NL80211_BANDS. However, this leads to out-of-bound\naccess in ieee80211_add_tx_radiotap_header when we try to access the\nsbands array.\nFix it by not accessing the array if the band is NUM_NL80211_BANDS.\nThis means that we will not report rate info for legacy rate in NAN.\nBut nobody really cares about it.", "A flaw was found in the Linux kernel's mac80211 wireless subsystem. When handling transmission frames in Neighbor Awareness Networking (NAN) mode, the system sets an invalid frequency band value that triggers an out-of-bounds array read during header processing. A local user able to trigger or monitor these transmissions could exploit this vulnerability to crash the system, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-97511", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97511\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97511\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97511.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,7f087f70e020b16a5b967332ee6e937817eaa173)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,03c41203ee5a833a9d7a7630be190830cede29d8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.18.53)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T00:30:18.224626+00:00", "updated": "2026-10-01T15:15:10.744011+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}