Look up another CVE · open CVE-2026-63869 in the interactive tracker

CVE-2026-63869

wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap

7.6 EPSS 0.2% AV:A

Published 2026-07-19 (3 months ago) by the Linux kernel CNA. Subsystem net/mac80211. Debian urgency: unimportant.

What to do, per Debian release

Debian's own status for CVE-2026-63869 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source

Release	Status	Version	What this means
Debian 12bookworm	not affected	6.1.190-1	Nothing to do. bookworm never shipped the vulnerable code.
Debian 13trixie	fixed	6.12.94-1	Update the kernel and reboot. Fixed in 6.12.94-1. A running kernel keeps the old code until the machine restarts.
Debian 14forky	fixed	7.0.13-1	Update the kernel and reboot. Fixed in 7.0.13-1. A running kernel keeps the old code until the machine restarts.
Debian unstablesid	fixed	7.0.13-1	Update the kernel and reboot. Fixed in 7.0.13-1. A running kernel keeps the old code until the machine restarts.

The vulnerability

What the bug is

When parsing the radiotap header of an injected frame, ieee80211_parse_tx_radiotap() uses the IEEE80211_RADIOTAP_ANTENNA value directly as a shift count: info->control.antennas |= BIT(*iterator.this_arg); *iterator.this_arg is an 8-bit value taken straight from the frame supplied by userspace, so BIT() can be asked to shift by up to 255. That is undefined behaviour on the unsigned long and is reported by UBSAN: UBSAN: shift-out-of-bounds in net/mac80211/tx.c:2174:30 shift exponent 235 is too large for 64-bit type 'unsigned long' Call Trace: ieee80211_parse_tx_radiotap+0xadb/0x1950 net/mac80211/tx.c:2174 ieee80211_monitor_start_xmit+0xb1f/0x1250 net/mac80211/tx.c:2451 ... packet_sendmsg+0x3eb6/0x50f0 net/packet/af_packet.c:3109 info->control.antennas is a 2-bit bitmap (u8 antennas:2), so only antenna indices 0 and 1 can ever be represented. Ignore any larger value instead of shifting out of bounds.

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

net/mac80211/tx.c

What this is: MAC80211MAINTAINERS section matched on net/mac80211/ · linux-wireless@vger.kernel.org · Maintained
Kernel module: mac80211

Check it on the machine

grep -w CONFIG_MAC80211 /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

lsmod | grep -w mac80211

Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.

Show whether Debian builds this, per release

Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.

bookwormMnot built on amd64/cloud-amd64, arm64/cloud-arm64
trixie, forky, sidMnot built on amd64/cloud-amd64, arm64/cloud-arm64, s390x/s390x

M: a module where it is built at all; some flavours do not build it

Build switch: CONFIG_MAC80211

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Debian tracker CVE record NVD kernel CNA record

Signals

Published: 2026-07-19 (3 months ago)source
CVSS: 7.6 high
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Lsource recompute it
Attack vector: adjacent network (AV:A)source
EPSS: 0.22%, higher than 12.0% of all CVEssource
CISA KEV: not listedthe KEV catalogue
Debian urgency: unimportantsource
Subsystem: net/mac80211

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
6.7	6.12.94	f6d3dc8e8492
6.7	6.18.36	9b40c59bab08
6.7	7.0.13	033ce021a220
6.7	7.1	6c0cf89f36ac

Why the CNA scored it this way

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:AAttack vector, adjacent network: The bug is in mac80211 WiFi frame injection (radiotap parsing on monitor-mode TX), reachable only on systems with WiFi hardware in monitor mode; per kernel CNA guidance, WiFi frame injection maps to Adjacent.
AC:LAttack complexity, low: The attacker fully controls the injected radiotap header via sendmsg() on an AF_PACKET socket and can reliably set IEEE80211_RADIOTAP_ANTENNA to any 8-bit value to trigger the out-of-bounds shift.
PR:LPrivileges required, low: Reaching the path requires CAP_NET_RAW to open AF_PACKET sockets and CAP_NET_ADMIN to create a monitor interface via nl80211; both capabilities are obtainable by an unprivileged user through user namespaces (unshare -Urn).
UI:NUser interaction, none: Exploitation requires no action from a victim user; the attacker injects crafted frames through their own local socket.
S:UScope, unchanged: Impact is confined to kernel memory and WiFi TX state within the same security authority; this is not a VM escape or cross-boundary sandbox breakout.
C:HConfidentiality impact, high: The unchecked antenna index causes shift-out-of-bounds undefined behavior while parsing attacker-controlled data into the skb control block (ieee80211_tx_info), constituting kernel memory corruption that could be leveraged for information disclosure.
I:HIntegrity impact, high: The undefined-behavior shift result is ORed into a bitfield in skb->cb, corrupting injection control metadata in kernel memory; such corruption in the TX path is potentially exploitable for further memory writes or control-flow manipulation.
A:LAvailability impact, low: The primary demonstrated impact is a UBSAN shift-out-of-bounds report rather than a demonstrated kernel panic, but undefined behavior during packet processing can still cause degraded or unpredictable system behavior.