GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-68471 (GCVE-0-2026-68471)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:51 – Updated: 2026-08-17 05:39
VLAI
Title
wifi: ieee80211: validate MLE common info length
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: ieee80211: validate MLE common info length ieee80211_mle_common_size() uses the first common-info octet as the common information length for all known MLE types. However, ieee80211_mle_size_ok() only validates that octet for Basic, Probe Request, and TDLS MLEs. Reconfiguration MLEs also skipped the length octet when calculating the minimum common size, and Priority Access MLEs skipped validation of the advertised common information length. Account for the Reconfiguration common-info length octet and validate the advertised common information length for all known MLE types. Keep unknown-type handling unchanged. [remove now misleading comment]
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada1 , < 90576bd6921a91eb038bffbb4b9467c2dc26aa1d (git)
Affected: 0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada1 , < 2b1589fd9a076727a73bfb39e96622a76415ad32 (git)
Affected: 0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada1 , < 293baeae9b2434a3e432629d7720b5603db2d77e (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.0
Unaffected: 0 , < 6.0 (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/ieee80211-eht.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "90576bd6921a91eb038bffbb4b9467c2dc26aa1d",
              "status": "affected",
              "version": "0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada1",
              "versionType": "git"
            },
            {
              "lessThan": "2b1589fd9a076727a73bfb39e96622a76415ad32",
              "status": "affected",
              "version": "0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada1",
              "versionType": "git"
            },
            {
              "lessThan": "293baeae9b2434a3e432629d7720b5603db2d77e",
              "status": "affected",
              "version": "0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/ieee80211-eht.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ieee80211: validate MLE common info length\n\nieee80211_mle_common_size() uses the first common-info octet as the\ncommon information length for all known MLE types. However,\nieee80211_mle_size_ok() only validates that octet for Basic, Probe\nRequest, and TDLS MLEs.\n\nReconfiguration MLEs also skipped the length octet when calculating the\nminimum common size, and Priority Access MLEs skipped validation of the\nadvertised common information length.\n\nAccount for the Reconfiguration common-info length octet and validate\nthe advertised common information length for all known MLE types. Keep\nunknown-type handling unchanged.\n\n[remove now misleading comment]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - Reachable by transmitting crafted 802.11 management frames (probe responses, beacons, protected EHT action frames) over WiFi; the mac80211/cfg80211 stack parses Multi-Link Elements on receive without requiring local access.\nAC:L - An adjacent attacker fully controls the MLE common-info length octet in forged frames and can reliably pass ieee80211_mle_size_ok() with an inflated value, triggering deterministic out-of-bounds parsing during routine scan or beacon processing.\nPR:N - No local privileges or association are required; a rogue AP or frame injector can deliver malicious MLEs to any scanning or MLD-associated station via standard pre-authentication WiFi management traffic.\nUI:N - Exploitation requires only passive reception of attacker-supplied WiFi frames during background scanning or normal beacon/action-frame handling; no victim interaction beyond having WiFi enabled.\nS:U - Impact is kernel heap out-of-bounds access within the WiFi stack on the victim host; it does not cross a VM, IOMMU, or sandbox security boundary to another authority.\nC:H - Inflated common_len makes ieee80211_mle_common_size() exceed the element buffer, causing for_each_element/cfg80211_defragment_element to read beyond the skb or kmalloc allocation, enabling unbounded kernel memory disclosure.\nI:H - The length underflow and out-of-bounds element iteration constitute exploitable kernel memory corruption; subsequent defragmentation and nested ie parsing can leverage corrupted pointers for arbitrary write primitives.\nA:H - Out-of-bounds reads of unmapped or non-element memory during MLE sub-element iteration can trigger a kernel oops or panic, remotely denying service to any WiFi-enabled device in range."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:39:14.035Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/90576bd6921a91eb038bffbb4b9467c2dc26aa1d"
        },
        {
          "url": "https://git.kernel.org/stable/c/2b1589fd9a076727a73bfb39e96622a76415ad32"
        },
        {
          "url": "https://git.kernel.org/stable/c/293baeae9b2434a3e432629d7720b5603db2d77e"
        }
      ],
      "title": "wifi: ieee80211: validate MLE common info length",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68471",
    "datePublished": "2026-08-15T05:51:29.001Z",
    "dateReserved": "2026-07-30T09:28:09.396Z",
    "dateUpdated": "2026-08-17T05:39:14.035Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68471",
      "date": "2026-09-04",
      "epss": "0.00314",
      "percentile": "0.23831"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-23T14:58:36.000Z",
      "cve": "CVE-2026-68471",
      "id": "msrc_CVE-2026-68471",
      "initial_release_date": "2026-08-23T14:58:36.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "wifi: ieee80211: validate MLE common info length",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-68471.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68471\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:20:05.433\",\"lastModified\":\"2026-08-17T06:17:56.513\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: ieee80211: validate MLE common info length\\n\\nieee80211_mle_common_size() uses the first common-info octet as the\\ncommon information length for all known MLE types. However,\\nieee80211_mle_size_ok() only validates that octet for Basic, Probe\\nRequest, and TDLS MLEs.\\n\\nReconfiguration MLEs also skipped the length octet when calculating the\\nminimum common size, and Priority Access MLEs skipped validation of the\\nadvertised common information length.\\n\\nAccount for the Reconfiguration common-info length octet and validate\\nthe advertised common information length for all known MLE types. Keep\\nunknown-type handling unchanged.\\n\\n[remove now misleading comment]\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"include/linux/ieee80211-eht.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada1\",\"lessThan\":\"90576bd6921a91eb038bffbb4b9467c2dc26aa1d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada1\",\"lessThan\":\"2b1589fd9a076727a73bfb39e96622a76415ad32\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada1\",\"lessThan\":\"293baeae9b2434a3e432629d7720b5603db2d77e\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"include/linux/ieee80211-eht.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.40\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/293baeae9b2434a3e432629d7720b5603db2d77e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2b1589fd9a076727a73bfb39e96622a76415ad32\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/90576bd6921a91eb038bffbb4b9467c2dc26aa1d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-17T15:28:26+00:00",
      "cve": "CVE-2026-68471",
      "id": "CVE-2026-68471",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: ieee80211: validate MLE common info length",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68471.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.