CVE-2026-68411

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211_hwsim: clamp virtio RX length before skb_put

hwsim_virtio_rx_work() passes the virtqueue used-ring length reported by

the device straight to skb_put() on a fixed-size receive skb. A backend

reporting a length larger than the skb tailroom drives skb_put() past the

buffer end and hits skb_over_panic() -- a host-triggerable guest panic

(denial of service).

Clamp the length to the skb's available room before skb_put(). A

conforming device never reports more than the posted buffer size, so valid

frames are unaffected; a truncated over-report then fails the

length/header checks in hwsim_virtio_handle_cmd() and is dropped, so

truncating rather than dropping here cannot be turned into a parsing

problem.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References