Description
The ieee80211_fragment function in net/mac80211/tx.c in the Linux kernel before 3.13.5 does not properly maintain a certain tail pointer, which allows remote attackers to obtain sensitive cleartext information by reading packets.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 3.14.2-1 | — |
| Debian 13 | linux | 3.14.2-1 | — |
| Debian 12 | linux | 3.14.2-1 | — |
| Debian 6.0 | linux-2.6 | 2.6.32-48squeeze10 | DLA-118-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | perf +17 | 3.10.0-229.el7 | RHSA-2015:0290 |
| RHEL 6 | perf +16 | 2.6.32-573.el6 | RHSA-2015:1272 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | perf +11 | 3.10.0-229.el7 | ELSA-2015-0290 |
Advisories 4
- RHSA-2015:1272 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2015:0290 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DLA-118-1 linux-2.6 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- ELSA-2015-0290 Important: kernel security, bug fix, and enhancement update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Mar 11, 2015
References
- 1037968 vdb-entry
- SUSE-SU-2015:0652 vendor-advisory
- https://github.com/torvalds/linux/commit/338f977f4eb441e69bb9a46eaa0ac715c931a67f
- RHSA-2015:0290 vendor-advisory
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.5
- SUSE-SU-2015:0481 vendor-advisory
- openSUSE-SU-2015:0566 vendor-advisory
- [oss-security] 20141109 Re: CVE Request: Linux kernel mac80211 plain text leak mailing-list
- linux-kernel-cve20148709-info-disclsoure(98922) vdb-entry
- RHSA-2015:1272 vendor-advisory
- 70965 vdb-entry
- https://source.android.com/security/bulletin/2017-03-01.html
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=338f977f4eb441e69bb9a46eaa0ac715c931a67f