CVE-2026-23367

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: radiotap: reject radiotap with unknown bits<br /> <br /> The radiotap parser is currently only used with the radiotap<br /> namespace (not with vendor namespaces), but if the undefined<br /> field 18 is used, the alignment/size is unknown as well. In<br /> this case, iterator-&gt;_next_ns_data isn&amp;#39;t initialized (it&amp;#39;s<br /> only set for skipping vendor namespaces), and syzbot points<br /> out that we later compare against this uninitialized value.<br /> <br /> Fix this by moving the rejection of unknown radiotap fields<br /> down to after the in-namespace lookup, so it will really use<br /> iterator-&gt;_next_ns_data only for vendor namespaces, even in<br /> case undefined fields are present.