Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-23367— wifi: radiotap: reject radiotap with unknown bits

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于radiotap解析器未正确初始化迭代器数据，可能导致使用未初始化值。

AI Predicted 5.5 Difficulty: Moderate EPSS 0.12% · P2

Possible ATT&CK Techniques 1 AI

T1200 · Hardware Additions

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 33e5a2f776e331dc8a4379b6efb660d38f182d96< 6f80f6a60f5d87e5de5fb2732751fce799991c24 affected
33e5a2f776e331dc8a4379b6efb660d38f182d96< d1d1d3c50095928624a95b67a6d7ccc3a18f2215 affected
33e5a2f776e331dc8a4379b6efb660d38f182d96< 703fa979badbba83d31cd011606d060bfb8b0d1d affected
33e5a2f776e331dc8a4379b6efb660d38f182d96< 129c8bb320a7cef692c78056ef8e89a2a12ba448 affected
33e5a2f776e331dc8a4379b6efb660d38f182d96< 2a60c588d5d39ad187628f58395c776a97fd4323 affected
33e5a2f776e331dc8a4379b6efb660d38f182d96< 2f8ceeba670610d66f77def32011f48de951d781 affected
33e5a2f776e331dc8a4379b6efb660d38f182d96< e664971759a0e5570b50c6592e58a7f97d55e992 affected
33e5a2f776e331dc8a4379b6efb660d38f182d96< c854758abe0b8d86f9c43dc060ff56a0ee5b31e0 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-23367

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
wifi: radiotap: reject radiotap with unknown bits
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: wifi: radiotap: reject radiotap with unknown bits The radiotap parser is currently only used with the radiotap namespace (not with vendor namespaces), but if the undefined field 18 is used, the alignment/size is unknown as well. In this case, iterator->_next_ns_data isn't initialized (it's only set for skipping vendor namespaces), and syzbot points out that we later compare against this uninitialized value. Fix this by moving the rejection of unknown radiotap fields down to after the in-namespace lookup, so it will really use iterator->_next_ns_data only for vendor namespaces, even in case undefined fields are present.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于radiotap解析器未正确初始化迭代器数据，可能导致使用未初始化值。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 33e5a2f776e331dc8a4379b6efb660d38f182d96 ~ 6f80f6a60f5d87e5de5fb2732751fce799991c24 -
Linux Linux 2.6.34 -

II. Public POCs for CVE-2026-23367

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-23367

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-23367 (6)

Same Patch Batch · Linux · 2026-03-25 · 116 CVEs total

CVE-2026-23395 8.8 HIGH Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ
CVE-2026-31788 8.2 HIGH xen/privcmd: restrict usage in unprivileged domU
CVE-2026-23340 7.8 HIGH net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs
CVE-2026-23336 7.8 HIGH wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()
CVE-2026-23350 7.8 HIGH drm/xe/queue: Call fini on exec queue creation fail
CVE-2026-23351 7.8 HIGH netfilter: nft_set_pipapo: split gc into unlink and reclaim phase
CVE-2026-23317 7.8 HIGH drm/vmwgfx: Return the correct value in vmw_translate_ptr functions
CVE-2026-23306 7.8 HIGH scsi: pm8001: Fix use-after-free in pm8001_queue_command()
CVE-2026-23372 7.8 HIGH nfc: rawsock: cancel tx_work before socket teardown
CVE-2026-23378 7.8 HIGH net/sched: act_ife: Fix metalist update behavior
CVE-2026-23383 7.8 HIGH bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing
CVE-2026-23391 7.8 HIGH netfilter: xt_CT: drop pending enqueued packets on template removal
CVE-2026-23392 7.8 HIGH netfilter: nf_tables: release flowtable after rcu grace period on error
CVE-2026-23393 7.8 HIGH bridge: cfm: Fix race condition in peer_mep deletion
CVE-2026-23280 7.8 HIGH accel/amdxdna: Prevent ubuf size overflow
CVE-2026-23288 7.8 HIGH accel/amdxdna: Fix out-of-bounds memset in command slot handling
CVE-2026-23364 7.4 HIGH ksmbd: Compare MACs in constant time
CVE-2026-23294 7.0 HIGH bpf: Fix race in devmap on PREEMPT_RT
CVE-2026-23352 x86/efi: defer freeing of boot services memory
CVE-2026-23354 x86/fred: Correct speculative safety in fred_extint()

Showing top 20 of 116 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-23367

No comments yet

Leave a comment