CVE-2026-68411: Linux Kernel mac80211_hwsim DoS Flaw

CVE-2026-68411 Overview

CVE-2026-68411 is a denial-of-service vulnerability in the Linux kernel's mac80211_hwsim wireless simulation driver. The flaw resides in hwsim_virtio_rx_work(), which passes the virtqueue used-ring length reported by the backend device directly to skb_put() on a fixed-size receive socket buffer (skb). A malicious or malfunctioning virtio backend can report a length larger than the skb tailroom, causing skb_put() to advance past the buffer end and trigger skb_over_panic(). The result is a host-triggerable guest kernel panic. The fix clamps the reported length to the skb's available room before calling skb_put().

Critical Impact

A malicious virtio backend can trigger a guest kernel panic through unvalidated RX length values, resulting in denial of service against Linux guests using mac80211_hwsim with virtio transport.

Affected Products

• Linux kernel (upstream) with mac80211_hwsim driver compiled with virtio transport support
• Linux distributions shipping vulnerable kernel versions prior to the fix commits
• Virtualized Linux guests exposing mac80211_hwsim to a virtio device backend

Discovery Timeline

• 2026-08-10 - CVE-2026-68411 published to NVD
• 2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68411

Vulnerability Analysis

The mac80211_hwsim driver simulates IEEE 802.11 wireless hardware and supports a virtio transport for exchanging frames with an external backend. In the receive path, hwsim_virtio_rx_work() allocates a fixed-size skb and posts it to the RX virtqueue. When the backend returns the buffer via the used ring, the driver reads the reported length and passes it directly to skb_put() to expose the received data to upper layers.

skb_put() performs no bounds check against the actual tailroom in production builds. If the reported length exceeds the skb's tailroom, the internal skb->tail pointer moves past skb->end, and the kernel invokes skb_over_panic(). This produces an immediate, unrecoverable panic in the guest kernel.

Root Cause

The root cause is missing input validation on device-supplied metadata [CWE-20]. The driver treats the virtqueue used-ring length as trusted despite it originating from an external backend that may be malicious, buggy, or compromised. No comparison is performed between the reported length and the allocated skb capacity before mutating skb state.

Attack Vector

An attacker who controls or influences the virtio backend, such as a compromised host-side vhost process or a hostile device emulator, sets a used-ring length greater than the posted RX buffer size. When the guest's hwsim_virtio_rx_work() processes that descriptor, skb_put() triggers skb_over_panic() and halts the guest. The attack requires no guest-side authentication and results in denial of service. The corrected code clamps the length to the skb's tailroom; frames truncated by clamping subsequently fail header checks in hwsim_virtio_handle_cmd() and are dropped, so clamping cannot be repurposed into a parsing bug.

See the Linux kernel commit fix for the exact patch.

Detection Methods for CVE-2026-68411

Indicators of Compromise

• Guest kernel panic messages referencing skb_over_panic with a call stack that includes hwsim_virtio_rx_work or mac80211_hwsim
• Unexpected guest reboots or hangs correlated with virtio-based mac80211_hwsim activity
• Kernel ring buffer entries showing oversized virtqueue used-ring lengths prior to panic

Detection Strategies

• Inventory Linux guests loading the mac80211_hwsim module with virtio transport enabled and compare kernel versions against the fix commits
• Monitor dmesg and syslog for skb_over_panic signatures and correlate with virtio device activity
• Review host-side vhost or virtio backend processes interacting with guests running mac80211_hwsim

Monitoring Recommendations

• Forward guest kernel logs to a centralized log platform and alert on skb_over_panic and mac80211_hwsim stack traces
• Track guest availability metrics for virtualized workloads that use mac80211_hwsim, particularly in Wi-Fi test and CI environments
• Audit which guests have mac80211_hwsim loaded in production, as it is primarily a testing driver and rarely needed at runtime

How to Mitigate CVE-2026-68411

Immediate Actions Required

• Apply the upstream Linux kernel patches that clamp the RX length before skb_put() in hwsim_virtio_rx_work()
• Update to a stable kernel release incorporating the fix commits referenced in the NVD entry
• If patching is not immediately possible, unload the mac80211_hwsim module on hosts where it is not required

Patch Information

The fix has been merged into the upstream Linux kernel across multiple stable branches. Relevant stable commits include 10a2b430f8f0, 6dc76371a9a3, 82c5a30a66e2, 99dc05c75acc, and fade308845c8. Apply the stable update matching your kernel branch.

Workarounds

• Blacklist or unload mac80211_hwsim on production guests that do not require simulated Wi-Fi hardware
• Restrict which virtio backends can attach to guest mac80211_hwsim instances to trusted host processes only
• Isolate test environments that rely on mac80211_hwsim from untrusted virtio backends and networks

# Blacklist the mac80211_hwsim module until the kernel is patched
echo "blacklist mac80211_hwsim" | sudo tee /etc/modprobe.d/blacklist-hwsim.conf
sudo rmmod mac80211_hwsim 2>/dev/null || true
sudo update-initramfs -u