CVE-2026-64223 (GCVE-0-2026-64223)

Vulnerability from cvelistv5 – Published: 2026-07-24 15:23 – Updated: 2026-08-05 12:40
VLAI
Title
wifi: mac80211: consume only present negotiated TTLM maps
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: consume only present negotiated TTLM maps ieee80211_tid_to_link_map_size_ok() validates negotiated TTLM elements against the number of link-map entries indicated by link_map_presence. ieee80211_parse_neg_ttlm() must consume the same layout. The parser advanced its cursor for every TID, including TIDs whose presence bit is clear and therefore have no map bytes in the element. A sparse map can then make a later present TID read past the validated element. The bad bytes land in neg_ttlm->{up,down}link[tid] but are gated by valid_links before being applied to driver state, so a peer cannot turn the read into a policy change. Under KUnit + KASAN with an exact-sized element allocation the OOB read is reported as a slab-out-of-bounds; whether the same trigger fires under the production RX path depends on surrounding allocator state. Advance the cursor only when the current TID has a map present.
Severity
8.1 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 8f500fbc6c655976c8062b1f1e55bd0b3095d6c2 , < f7d395dc5008168ac5b9c1ac2791e59a6078cca1 (git)
Affected: 8f500fbc6c655976c8062b1f1e55bd0b3095d6c2 , < 2dd9304727c7041df0a599595910bdbe02ad03c5 (git)
Affected: 8f500fbc6c655976c8062b1f1e55bd0b3095d6c2 , < 2becaaeebe230ade1fcd5d0f1cde4d6ee93ec78f (git)
Affected: 8f500fbc6c655976c8062b1f1e55bd0b3095d6c2 , < a6e6ccd5bd07155c2add6c74ce1a5e68ad3b95ea (git)
Create a notification for this product.
Linux Linux Affected: 6.9
Unaffected: 0 , < 6.9 (semver)
Unaffected: 6.12.92 , ≤ 6.12.* (semver)
Unaffected: 6.18.34 , ≤ 6.18.* (semver)
Unaffected: 7.0.11 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/mlme.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f7d395dc5008168ac5b9c1ac2791e59a6078cca1",
              "status": "affected",
              "version": "8f500fbc6c655976c8062b1f1e55bd0b3095d6c2",
              "versionType": "git"
            },
            {
              "lessThan": "2dd9304727c7041df0a599595910bdbe02ad03c5",
              "status": "affected",
              "version": "8f500fbc6c655976c8062b1f1e55bd0b3095d6c2",
              "versionType": "git"
            },
            {
              "lessThan": "2becaaeebe230ade1fcd5d0f1cde4d6ee93ec78f",
              "status": "affected",
              "version": "8f500fbc6c655976c8062b1f1e55bd0b3095d6c2",
              "versionType": "git"
            },
            {
              "lessThan": "a6e6ccd5bd07155c2add6c74ce1a5e68ad3b95ea",
              "status": "affected",
              "version": "8f500fbc6c655976c8062b1f1e55bd0b3095d6c2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/mlme.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: consume only present negotiated TTLM maps\n\nieee80211_tid_to_link_map_size_ok() validates negotiated TTLM elements\nagainst the number of link-map entries indicated by link_map_presence.\nieee80211_parse_neg_ttlm() must consume the same layout.\n\nThe parser advanced its cursor for every TID, including TIDs whose\npresence bit is clear and therefore have no map bytes in the element.\nA sparse map can then make a later present TID read past the validated\nelement.\n\nThe bad bytes land in neg_ttlm-\u003e{up,down}link[tid] but are gated by\nvalid_links before being applied to driver state, so a peer cannot\nturn the read into a policy change.  Under KUnit + KASAN with an\nexact-sized element allocation the OOB read is reported as a\nslab-out-of-bounds; whether the same trigger fires under the\nproduction RX path depends on surrounding allocator state.\n\nAdvance the cursor only when the current TID has a map present."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - A malicious or spoofed Wi-Fi 7 MLO peer can trigger the parser using an over-the-air Protected EHT TTLM request, requiring radio-network adjacency.\nAC:L - A crafted sparse link_map_presence deterministically causes the invalid cursor advancement and OOB read; no race or condition outside the attacker\u2019s control is required to reach the flaw.\nPR:N - The attacker needs no local account, capability, or target-system privilege; an associated malicious AP/MLD peer can supply the frame.\nUI:N - Once the station is connected to the malicious or compromised AP, the crafted management frame is processed automatically without user action.\nS:U - The vulnerable parser and resulting impacts remain within the host kernel\u2019s existing security authority and do not cross a VM, IOMMU, or sandbox boundary.\nC:H - Sparse maps cause multiple one- or two-byte reads beyond the validated element into surrounding kernel allocation state. Applying the required higher-severity choice for an OOB kernel read, potential disclosure of adjacent kernel memory is scored High.\nI:N - All writes remain within the bounded neg_ttlm arrays, and parsed link values are checked against valid_links before driver-state application; there is no OOB write or control-flow corruption primitive.\nA:H - An exact-sized allocation produces a KASAN slab-out-of-bounds report, which can panic sanitizer-enabled kernels, and the peer can repeatedly send the trigger. Although production behavior depends on RX-buffer allocation state, the required higher-severity choice supports High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:40:10.599Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f7d395dc5008168ac5b9c1ac2791e59a6078cca1"
        },
        {
          "url": "https://git.kernel.org/stable/c/2dd9304727c7041df0a599595910bdbe02ad03c5"
        },
        {
          "url": "https://git.kernel.org/stable/c/2becaaeebe230ade1fcd5d0f1cde4d6ee93ec78f"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6e6ccd5bd07155c2add6c74ce1a5e68ad3b95ea"
        }
      ],
      "title": "wifi: mac80211: consume only present negotiated TTLM maps",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64223",
    "datePublished": "2026-07-24T15:23:08.629Z",
    "dateReserved": "2026-07-19T15:36:31.770Z",
    "dateUpdated": "2026-08-05T12:40:10.599Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64223",
      "date": "2026-08-09",
      "epss": "0.00256",
      "percentile": "0.17133"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-64223\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-24T16:16:50.197\",\"lastModified\":\"2026-07-30T15:00:27.343\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: mac80211: consume only present negotiated TTLM maps\\n\\nieee80211_tid_to_link_map_size_ok() validates negotiated TTLM elements\\nagainst the number of link-map entries indicated by link_map_presence.\\nieee80211_parse_neg_ttlm() must consume the same layout.\\n\\nThe parser advanced its cursor for every TID, including TIDs whose\\npresence bit is clear and therefore have no map bytes in the element.\\nA sparse map can then make a later present TID read past the validated\\nelement.\\n\\nThe bad bytes land in neg_ttlm-\u003e{up,down}link[tid] but are gated by\\nvalid_links before being applied to driver state, so a peer cannot\\nturn the read into a policy change.  Under KUnit + KASAN with an\\nexact-sized element allocation the OOB read is reported as a\\nslab-out-of-bounds; whether the same trigger fires under the\\nproduction RX path depends on surrounding allocator state.\\n\\nAdvance the cursor only when the current TID has a map present.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/mac80211/mlme.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"8f500fbc6c655976c8062b1f1e55bd0b3095d6c2\",\"lessThan\":\"f7d395dc5008168ac5b9c1ac2791e59a6078cca1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8f500fbc6c655976c8062b1f1e55bd0b3095d6c2\",\"lessThan\":\"2dd9304727c7041df0a599595910bdbe02ad03c5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8f500fbc6c655976c8062b1f1e55bd0b3095d6c2\",\"lessThan\":\"2becaaeebe230ade1fcd5d0f1cde4d6ee93ec78f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8f500fbc6c655976c8062b1f1e55bd0b3095d6c2\",\"lessThan\":\"a6e6ccd5bd07155c2add6c74ce1a5e68ad3b95ea\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/mac80211/mlme.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.9\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.9\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.92\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.34\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.11\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2becaaeebe230ade1fcd5d0f1cde4d6ee93ec78f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2dd9304727c7041df0a599595910bdbe02ad03c5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a6e6ccd5bd07155c2add6c74ce1a5e68ad3b95ea\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f7d395dc5008168ac5b9c1ac2791e59a6078cca1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-28T11:38:32+00:00",
      "cve": "CVE-2026-64223",
      "id": "CVE-2026-64223",
      "initial_release_date": "2026-07-24T00:00:00+00:00",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: mac80211: consume only present negotiated TTLM maps",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64223.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.