CVE-2026-63869: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-63869 Overview

CVE-2026-63869 is a shift-out-of-bounds vulnerability in the Linux kernel mac80211 subsystem. The flaw resides in ieee80211_parse_tx_radiotap() in net/mac80211/tx.c, which processes radiotap headers on injected Wi-Fi frames. The function uses an untrusted 8-bit IEEE80211_RADIOTAP_ANTENNA value directly as a shift count in a BIT() macro, producing undefined behavior when the value exceeds the width of an unsigned long. UBSAN flags the condition at runtime. A local attacker on an adjacent network with the ability to inject frames through a monitor-mode interface can trigger the flaw.

Critical Impact
A local user with packet injection privileges can trigger undefined behavior in the kernel's Wi-Fi transmit path, leading to kernel instability and possible denial of service.

Affected Products

Linux kernel mac80211 subsystem (net/mac80211/tx.c)
Kernel builds exposing monitor-mode Wi-Fi interfaces with radiotap injection
Distributions shipping affected upstream kernel versions prior to the fix commits

Discovery Timeline

2026-07-19 - CVE-2026-63869 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63869

Vulnerability Analysis

The vulnerability lives in ieee80211_parse_tx_radiotap(), invoked when userspace transmits a frame through a monitor-mode interface using packet_sendmsg() and ieee80211_monitor_start_xmit(). When parsing the radiotap header, the function reads the antenna field and applies it directly as a bit-shift exponent:

info->control.antennas |= BIT(*iterator.this_arg);

Because *iterator.this_arg is an 8-bit value supplied by userspace, the shift can range up to 255 bits. Shifts equal to or greater than the operand width are undefined behavior in C for unsigned long types. UBSAN reports the exponent as "too large for 64-bit type 'unsigned long'" from net/mac80211/tx.c:2174.

Root Cause

The info->control.antennas field is declared as a 2-bit bitmap (u8 antennas:2), so only antenna indices 0 and 1 are representable. The parser missed a bounds check on the attacker-controlled antenna index before using it as a shift exponent, resulting in an out-of-range shift [CWE-1335]. The upstream fix rejects any antenna value larger than the representable range instead of performing the shift.

Attack Vector

Exploitation requires local access to a system with a monitor-mode Wi-Fi interface and permissions to send raw packets, typically CAP_NET_RAW. An attacker crafts a radiotap header containing a specially chosen IEEE80211_RADIOTAP_ANTENNA byte and injects it through an AF_PACKET socket. The malformed frame reaches ieee80211_parse_tx_radiotap(), triggering the out-of-bounds shift inside the kernel transmit path. The vulnerability manifests during frame injection, so no remote unauthenticated access is required. See the kernel patch commits for the corrective bounds check.

Detection Methods for CVE-2026-63869

Indicators of Compromise

UBSAN kernel log entries referencing shift-out-of-bounds in net/mac80211/tx.c with call traces through ieee80211_parse_tx_radiotap and ieee80211_monitor_start_xmit.
Unexpected kernel warnings or oops messages originating from monitor-mode Wi-Fi interfaces (e.g., mon0).
Unauthorized processes holding CAP_NET_RAW and opening AF_PACKET sockets against wireless interfaces.

Detection Strategies

Monitor dmesg and journalctl -k for UBSAN reports referencing net/mac80211/tx.c shift errors.
Audit installed kernel versions against the fixed upstream commits 033ce021, 6c0cf89f, 9b40c59b, and f6d3dc8e.
Baseline processes that create monitor-mode interfaces or send raw 802.11 frames, alerting on unexpected users invoking iw, airmon-ng, or custom injectors.

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on UBSAN and kernel oops events.
Track auditd events for socket(AF_PACKET, SOCK_RAW, ...) calls on wireless devices.
Track use of CAP_NET_RAW and monitor-mode interface creation across managed Linux endpoints.

How to Mitigate CVE-2026-63869

Immediate Actions Required

Apply distribution-provided kernel updates that incorporate the upstream fix commits 033ce021, 6c0cf89f, 9b40c59b, and f6d3dc8e.
Restrict CAP_NET_RAW and disable unused monitor-mode Wi-Fi interfaces on production systems.
Inventory endpoints running vulnerable kernel versions and prioritize patching hosts that use Wi-Fi packet injection tooling.

Patch Information

The upstream Linux kernel patch adds a bounds check that ignores any IEEE80211_RADIOTAP_ANTENNA value larger than the representable antenna index instead of shifting out of bounds. Fix commits are available at Kernel Git Commit 033ce021, Kernel Git Commit 6c0cf89f, Kernel Git Commit 9b40c59b, and Kernel Git Commit f6d3dc8e. Consult your distribution's security tracker for backports.

Workarounds

Remove CAP_NET_RAW from untrusted users and containers to block raw frame injection.
Unload or block the mac80211 module on servers that do not require wireless connectivity.
Avoid creating monitor-mode interfaces on multi-tenant hosts until the kernel is patched.

bash

# Remove monitor-mode interface and drop CAP_NET_RAW from a user session
sudo iw dev mon0 del
sudo setcap -r /usr/bin/tcpdump