CVE-2026-23367

Vulnerability

Analysis

The Linux kernel's radiotap parser, used to parse radiotap headers, has a flaw where undefined field 18 (unknown bits) leads to uninitialized use of iterator->_next_ns_data. This variable is only properly set for vendor namespaces, but when an undefined field appears in the radiotap namespace, it remains uninitialized, later causing a comparison against this garbage value [1].

Exploitation

An attacker who can inject crafted radiotap headers (e.g., through crafted Wi-Fi frames) can trigger this condition. The vulnerability was discovered via syzbot, indicating it can be triggered without special privileges beyond the ability to submit radiotap data [1].

Impact

The use of uninitialized data can lead to kernel information disclosure or a denial-of-service (system crash). The exact impact is undefined behavior, but given the kernel context, it poses a risk to confidentiality and availability with a CVSS v3 base score of 5.5 (Medium).

Mitigation

The fix was applied by moving the rejection of unknown radiotap fields after the in-namespace lookup, ensuring _next_ns_data is only used for vendor namespaces. The patches are available in the stable kernel repositories [1].