CVE-2026-23367 (GCVE-0-2026-23367)
Vulnerability from cvelistv5
Published
2026-03-25 10:27
Modified
2026-05-11 22:05
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: radiotap: reject radiotap with unknown bits The radiotap parser is currently only used with the radiotap namespace (not with vendor namespaces), but if the undefined field 18 is used, the alignment/size is unknown as well. In this case, iterator->_next_ns_data isn't initialized (it's only set for skipping vendor namespaces), and syzbot points out that we later compare against this uninitialized value. Fix this by moving the rejection of unknown radiotap fields down to after the in-namespace lookup, so it will really use iterator->_next_ns_data only for vendor namespaces, even in case undefined fields are present.
References
Impacted products
Vendor Product Version
Linux Linux Version: 33e5a2f776e331dc8a4379b6efb660d38f182d96
Version: 33e5a2f776e331dc8a4379b6efb660d38f182d96
Version: 33e5a2f776e331dc8a4379b6efb660d38f182d96
Version: 33e5a2f776e331dc8a4379b6efb660d38f182d96
Version: 33e5a2f776e331dc8a4379b6efb660d38f182d96
Version: 33e5a2f776e331dc8a4379b6efb660d38f182d96
Version: 33e5a2f776e331dc8a4379b6efb660d38f182d96
Version: 33e5a2f776e331dc8a4379b6efb660d38f182d96
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/radiotap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6f80f6a60f5d87e5de5fb2732751fce799991c24",
              "status": "affected",
              "version": "33e5a2f776e331dc8a4379b6efb660d38f182d96",
              "versionType": "git"
            },
            {
              "lessThan": "d1d1d3c50095928624a95b67a6d7ccc3a18f2215",
              "status": "affected",
              "version": "33e5a2f776e331dc8a4379b6efb660d38f182d96",
              "versionType": "git"
            },
            {
              "lessThan": "703fa979badbba83d31cd011606d060bfb8b0d1d",
              "status": "affected",
              "version": "33e5a2f776e331dc8a4379b6efb660d38f182d96",
              "versionType": "git"
            },
            {
              "lessThan": "129c8bb320a7cef692c78056ef8e89a2a12ba448",
              "status": "affected",
              "version": "33e5a2f776e331dc8a4379b6efb660d38f182d96",
              "versionType": "git"
            },
            {
              "lessThan": "2a60c588d5d39ad187628f58395c776a97fd4323",
              "status": "affected",
              "version": "33e5a2f776e331dc8a4379b6efb660d38f182d96",
              "versionType": "git"
            },
            {
              "lessThan": "2f8ceeba670610d66f77def32011f48de951d781",
              "status": "affected",
              "version": "33e5a2f776e331dc8a4379b6efb660d38f182d96",
              "versionType": "git"
            },
            {
              "lessThan": "e664971759a0e5570b50c6592e58a7f97d55e992",
              "status": "affected",
              "version": "33e5a2f776e331dc8a4379b6efb660d38f182d96",
              "versionType": "git"
            },
            {
              "lessThan": "c854758abe0b8d86f9c43dc060ff56a0ee5b31e0",
              "status": "affected",
              "version": "33e5a2f776e331dc8a4379b6efb660d38f182d96",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/radiotap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.34"
            },
            {
              "lessThan": "2.6.34",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.77",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.17",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.77",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.17",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.7",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: radiotap: reject radiotap with unknown bits\n\nThe radiotap parser is currently only used with the radiotap\nnamespace (not with vendor namespaces), but if the undefined\nfield 18 is used, the alignment/size is unknown as well. In\nthis case, iterator-\u003e_next_ns_data isn\u0027t initialized (it\u0027s\nonly set for skipping vendor namespaces), and syzbot points\nout that we later compare against this uninitialized value.\n\nFix this by moving the rejection of unknown radiotap fields\ndown to after the in-namespace lookup, so it will really use\niterator-\u003e_next_ns_data only for vendor namespaces, even in\ncase undefined fields are present."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:05:30.219Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6f80f6a60f5d87e5de5fb2732751fce799991c24"
        },
        {
          "url": "https://git.kernel.org/stable/c/d1d1d3c50095928624a95b67a6d7ccc3a18f2215"
        },
        {
          "url": "https://git.kernel.org/stable/c/703fa979badbba83d31cd011606d060bfb8b0d1d"
        },
        {
          "url": "https://git.kernel.org/stable/c/129c8bb320a7cef692c78056ef8e89a2a12ba448"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a60c588d5d39ad187628f58395c776a97fd4323"
        },
        {
          "url": "https://git.kernel.org/stable/c/2f8ceeba670610d66f77def32011f48de951d781"
        },
        {
          "url": "https://git.kernel.org/stable/c/e664971759a0e5570b50c6592e58a7f97d55e992"
        },
        {
          "url": "https://git.kernel.org/stable/c/c854758abe0b8d86f9c43dc060ff56a0ee5b31e0"
        }
      ],
      "title": "wifi: radiotap: reject radiotap with unknown bits",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23367",
    "datePublished": "2026-03-25T10:27:49.068Z",
    "dateReserved": "2026-01-13T15:37:46.003Z",
    "dateUpdated": "2026-05-11T22:05:30.219Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.