CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's mac80211_hwsim component, where improper handling of virtio RX length can lead to a host-triggerable denial of service by causing a guest panic. This occurs when a backend reports a length exceeding the available buffer size, leading to a buffer overflow during packet processing. System administrators and developers utilizing Linux kernel versions with this component should prioritize applying the patch to mitigate potential service disruptions.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: clamp virtio RX length before skb_put hwsim_virtio_rx_work() passes the virtqueue used-ring length reported by the device straight to skb_put() on a fixed-size receive skb. A backend reporting a length larger than the skb tailroom drives skb_put() past the buffer end and hits skb_over_panic() -- a host-triggerable guest panic (denial of service). Clamp the length to the skb's available room before skb_put(). A conforming device never reports more than the posted buffer size, so valid frames are unaffected; a truncated over-report then fails the length/header checks in hwsim_virtio_handle_cmd() and is dropped, so truncating rather than dropping here cannot be turned into a parsing problem.