CVE-2026-23367 (GCVE-0-2026-23367)

Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-04-18 08:58
VLAI?
Title
wifi: radiotap: reject radiotap with unknown bits
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: radiotap: reject radiotap with unknown bits The radiotap parser is currently only used with the radiotap namespace (not with vendor namespaces), but if the undefined field 18 is used, the alignment/size is unknown as well. In this case, iterator->_next_ns_data isn't initialized (it's only set for skipping vendor namespaces), and syzbot points out that we later compare against this uninitialized value. Fix this by moving the rejection of unknown radiotap fields down to after the in-namespace lookup, so it will really use iterator->_next_ns_data only for vendor namespaces, even in case undefined fields are present.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 33e5a2f776e331dc8a4379b6efb660d38f182d96 , < 6f80f6a60f5d87e5de5fb2732751fce799991c24 (git)
Affected: 33e5a2f776e331dc8a4379b6efb660d38f182d96 , < d1d1d3c50095928624a95b67a6d7ccc3a18f2215 (git)
Affected: 33e5a2f776e331dc8a4379b6efb660d38f182d96 , < 703fa979badbba83d31cd011606d060bfb8b0d1d (git)
Affected: 33e5a2f776e331dc8a4379b6efb660d38f182d96 , < 129c8bb320a7cef692c78056ef8e89a2a12ba448 (git)
Affected: 33e5a2f776e331dc8a4379b6efb660d38f182d96 , < 2a60c588d5d39ad187628f58395c776a97fd4323 (git)
Affected: 33e5a2f776e331dc8a4379b6efb660d38f182d96 , < 2f8ceeba670610d66f77def32011f48de951d781 (git)
Affected: 33e5a2f776e331dc8a4379b6efb660d38f182d96 , < e664971759a0e5570b50c6592e58a7f97d55e992 (git)
Affected: 33e5a2f776e331dc8a4379b6efb660d38f182d96 , < c854758abe0b8d86f9c43dc060ff56a0ee5b31e0 (git)
Create a notification for this product.
    Linux Linux Affected: 2.6.34
Unaffected: 0 , < 2.6.34 (semver)
Unaffected: 5.10.253 , ≤ 5.10.* (semver)
Unaffected: 5.15.203 , ≤ 5.15.* (semver)
Unaffected: 6.1.167 , ≤ 6.1.* (semver)
Unaffected: 6.6.130 , ≤ 6.6.* (semver)
Unaffected: 6.12.77 , ≤ 6.12.* (semver)
Unaffected: 6.18.17 , ≤ 6.18.* (semver)
Unaffected: 6.19.7 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/radiotap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6f80f6a60f5d87e5de5fb2732751fce799991c24",
              "status": "affected",
              "version": "33e5a2f776e331dc8a4379b6efb660d38f182d96",
              "versionType": "git"
            },
            {
              "lessThan": "d1d1d3c50095928624a95b67a6d7ccc3a18f2215",
              "status": "affected",
              "version": "33e5a2f776e331dc8a4379b6efb660d38f182d96",
              "versionType": "git"
            },
            {
              "lessThan": "703fa979badbba83d31cd011606d060bfb8b0d1d",
              "status": "affected",
              "version": "33e5a2f776e331dc8a4379b6efb660d38f182d96",
              "versionType": "git"
            },
            {
              "lessThan": "129c8bb320a7cef692c78056ef8e89a2a12ba448",
              "status": "affected",
              "version": "33e5a2f776e331dc8a4379b6efb660d38f182d96",
              "versionType": "git"
            },
            {
              "lessThan": "2a60c588d5d39ad187628f58395c776a97fd4323",
              "status": "affected",
              "version": "33e5a2f776e331dc8a4379b6efb660d38f182d96",
              "versionType": "git"
            },
            {
              "lessThan": "2f8ceeba670610d66f77def32011f48de951d781",
              "status": "affected",
              "version": "33e5a2f776e331dc8a4379b6efb660d38f182d96",
              "versionType": "git"
            },
            {
              "lessThan": "e664971759a0e5570b50c6592e58a7f97d55e992",
              "status": "affected",
              "version": "33e5a2f776e331dc8a4379b6efb660d38f182d96",
              "versionType": "git"
            },
            {
              "lessThan": "c854758abe0b8d86f9c43dc060ff56a0ee5b31e0",
              "status": "affected",
              "version": "33e5a2f776e331dc8a4379b6efb660d38f182d96",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/radiotap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.34"
            },
            {
              "lessThan": "2.6.34",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.77",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.17",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.77",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.17",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.7",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: radiotap: reject radiotap with unknown bits\n\nThe radiotap parser is currently only used with the radiotap\nnamespace (not with vendor namespaces), but if the undefined\nfield 18 is used, the alignment/size is unknown as well. In\nthis case, iterator-\u003e_next_ns_data isn\u0027t initialized (it\u0027s\nonly set for skipping vendor namespaces), and syzbot points\nout that we later compare against this uninitialized value.\n\nFix this by moving the rejection of unknown radiotap fields\ndown to after the in-namespace lookup, so it will really use\niterator-\u003e_next_ns_data only for vendor namespaces, even in\ncase undefined fields are present."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-18T08:58:14.832Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6f80f6a60f5d87e5de5fb2732751fce799991c24"
        },
        {
          "url": "https://git.kernel.org/stable/c/d1d1d3c50095928624a95b67a6d7ccc3a18f2215"
        },
        {
          "url": "https://git.kernel.org/stable/c/703fa979badbba83d31cd011606d060bfb8b0d1d"
        },
        {
          "url": "https://git.kernel.org/stable/c/129c8bb320a7cef692c78056ef8e89a2a12ba448"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a60c588d5d39ad187628f58395c776a97fd4323"
        },
        {
          "url": "https://git.kernel.org/stable/c/2f8ceeba670610d66f77def32011f48de951d781"
        },
        {
          "url": "https://git.kernel.org/stable/c/e664971759a0e5570b50c6592e58a7f97d55e992"
        },
        {
          "url": "https://git.kernel.org/stable/c/c854758abe0b8d86f9c43dc060ff56a0ee5b31e0"
        }
      ],
      "title": "wifi: radiotap: reject radiotap with unknown bits",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23367",
    "datePublished": "2026-03-25T10:27:49.068Z",
    "dateReserved": "2026-01-13T15:37:46.003Z",
    "dateUpdated": "2026-04-18T08:58:14.832Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-23367",
      "date": "2026-04-25",
      "epss": "0.00013",
      "percentile": "0.02275"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-23367\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-03-25T11:16:36.000\",\"lastModified\":\"2026-04-24T18:41:25.547\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: radiotap: reject radiotap with unknown bits\\n\\nThe radiotap parser is currently only used with the radiotap\\nnamespace (not with vendor namespaces), but if the undefined\\nfield 18 is used, the alignment/size is unknown as well. In\\nthis case, iterator-\u003e_next_ns_data isn\u0027t initialized (it\u0027s\\nonly set for skipping vendor namespaces), and syzbot points\\nout that we later compare against this uninitialized value.\\n\\nFix this by moving the rejection of unknown radiotap fields\\ndown to after the in-namespace lookup, so it will really use\\niterator-\u003e_next_ns_data only for vendor namespaces, even in\\ncase undefined fields are present.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nwifi: radiotap: rechazar radiotap con bits desconocidos\\n\\nEl analizador de radiotap actualmente solo se utiliza con el espacio de nombres de radiotap (no con espacios de nombres de proveedor), pero si se utiliza el campo indefinido 18, la alineaci\u00f3n/tama\u00f1o tambi\u00e9n es desconocido. En este caso, iterator-\u0026gt;_next_ns_data no est\u00e1 inicializado (solo se establece para omitir espacios de nombres de proveedor), y syzbot se\u00f1ala que m\u00e1s tarde comparamos con este valor no inicializado.\\n\\nEsto se soluciona moviendo el rechazo de campos radiotap desconocidos a despu\u00e9s de la b\u00fasqueda dentro del espacio de nombres, para que realmente utilice iterator-\u0026gt;_next_ns_data solo para espacios de nombres de proveedor, incluso en caso de que haya campos indefinidos.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.34.1\",\"versionEndExcluding\":\"5.10.253\",\"matchCriteriaId\":\"F8124DB0-E974-47F7-A4CE-1F4CEA46F14B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.203\",\"matchCriteriaId\":\"20DDB3E9-AABF-4107-ADB0-5362AA067045\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.167\",\"matchCriteriaId\":\"2EDC6BAF-B710-4E26-B6AA-D68922EE7B43\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.130\",\"matchCriteriaId\":\"C57BB918-DF28-46B3-94F7-144176841267\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.77\",\"matchCriteriaId\":\"B3D12E00-E42D-4056-B354-BAD4903C03A5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.17\",\"matchCriteriaId\":\"A5E006E4-59C7-43C1-9231-62A72219F2BA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.7\",\"matchCriteriaId\":\"69245D10-0B71-485E-80C3-A64F077004D3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.34:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"A3B1BC1D-ED46-4364-A1D9-1FA74182B03A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F253B622-8837-4245-BCE5-A7BF8FC76A16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F666C8D8-6538-46D4-B318-87610DE64C34\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"02259FDA-961B-47BC-AE7F-93D7EC6E90C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"1D2315C0-D46F-4F85-9754-F9E5E11374A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"512EE3A8-A590-4501-9A94-5D4B268D6138\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/129c8bb320a7cef692c78056ef8e89a2a12ba448\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2a60c588d5d39ad187628f58395c776a97fd4323\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2f8ceeba670610d66f77def32011f48de951d781\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6f80f6a60f5d87e5de5fb2732751fce799991c24\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/703fa979badbba83d31cd011606d060bfb8b0d1d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c854758abe0b8d86f9c43dc060ff56a0ee5b31e0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d1d1d3c50095928624a95b67a6d7ccc3a18f2215\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e664971759a0e5570b50c6592e58a7f97d55e992\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.