Linux Kernel mac80211 Channel Handling Vulnerability in Scan Request

A vulnerability in the Linux kernel's mac80211 component has been addressed. The issue involved improper handling of the number of channels in the scan request process. Specifically, the number of channels was not correctly set after allocating the scan request structure, leading to an out-of-bounds array access. This vulnerability was identified using syzkaller, which reported a Undefined Behavior Sanitizer (UBSAN) error indicating that the index was out of range for the expected channel array type.

Impact

Exploitation of this vulnerability could lead to out-of-bounds memory access, potentially causing undefined behavior in the kernel.