CVE-2026-64174 (GCVE-0-2026-64174)

Vulnerability from cvelistv5 – Published: 2026-07-19 15:40 – Updated: 2026-07-19 15:40
VLAI
Title
wifi: cfg80211: advance loop vars in cfg80211_merge_profile()
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: advance loop vars in cfg80211_merge_profile() cfg80211_merge_profile() reassembles a Multi-BSSID non-transmitted BSS profile that has been split across multiple consecutive MBSSID elements. Its while-loop calls cfg80211_get_profile_continuation(ie, ielen, mbssid_elem, sub_elem) but never advances mbssid_elem or sub_elem inside the body. Each iteration therefore searches for a continuation that follows the same fixed pair; the helper returns the same next_mbssid; and the same next_sub bytes are memcpy()'d into merged_ie at a growing offset until the buffer fills. Advance both mbssid_elem and sub_elem to the just-consumed continuation so the next call to cfg80211_get_profile_continuation() searches for a further continuation beyond it (or returns NULL when none exists). A specially-crafted malicious beacon can take advantage of this bug to cause the kernel to spend an excessive amount of time in cfg80211_merge_profile (up to as much as 2ms per beacon received), which could theoretically be abused in some way.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: fe806e4992c9047affd263bcc13b2c047029a726 , < 5817e1e5205498a5df66eba2b34e817f4210fd0f (git)
Affected: fe806e4992c9047affd263bcc13b2c047029a726 , < cedbb608494ba1e7a5c6c56b7f1d3fd470094f28 (git)
Affected: fe806e4992c9047affd263bcc13b2c047029a726 , < c0bc4c8bd556cbe036a5b9ed333c0aab9aadfcb8 (git)
Affected: fe806e4992c9047affd263bcc13b2c047029a726 , < 1ced0f5a851f9cae274545a42a06c459b7fd8881 (git)
Affected: fe806e4992c9047affd263bcc13b2c047029a726 , < 67915715fd3874057457363c87c63e18829527df (git)
Affected: fe806e4992c9047affd263bcc13b2c047029a726 , < 6cfae4914439878b8acb35c7e3b40096eeb2ad9c (git)
Affected: fe806e4992c9047affd263bcc13b2c047029a726 , < 1343a480f84b80c1249133a90ef87f8751d65cbb (git)
Affected: fe806e4992c9047affd263bcc13b2c047029a726 , < 7666dbb1bacc4ba522b96740cba7283d243d16e1 (git)
Create a notification for this product.
Linux Linux Affected: 5.2
Unaffected: 0 , < 5.2 (semver)
Unaffected: 5.10.258 , ≤ 5.10.* (semver)
Unaffected: 5.15.209 , ≤ 5.15.* (semver)
Unaffected: 6.1.175 , ≤ 6.1.* (semver)
Unaffected: 6.6.142 , ≤ 6.6.* (semver)
Unaffected: 6.12.92 , ≤ 6.12.* (semver)
Unaffected: 6.18.34 , ≤ 6.18.* (semver)
Unaffected: 7.0.11 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/scan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5817e1e5205498a5df66eba2b34e817f4210fd0f",
              "status": "affected",
              "version": "fe806e4992c9047affd263bcc13b2c047029a726",
              "versionType": "git"
            },
            {
              "lessThan": "cedbb608494ba1e7a5c6c56b7f1d3fd470094f28",
              "status": "affected",
              "version": "fe806e4992c9047affd263bcc13b2c047029a726",
              "versionType": "git"
            },
            {
              "lessThan": "c0bc4c8bd556cbe036a5b9ed333c0aab9aadfcb8",
              "status": "affected",
              "version": "fe806e4992c9047affd263bcc13b2c047029a726",
              "versionType": "git"
            },
            {
              "lessThan": "1ced0f5a851f9cae274545a42a06c459b7fd8881",
              "status": "affected",
              "version": "fe806e4992c9047affd263bcc13b2c047029a726",
              "versionType": "git"
            },
            {
              "lessThan": "67915715fd3874057457363c87c63e18829527df",
              "status": "affected",
              "version": "fe806e4992c9047affd263bcc13b2c047029a726",
              "versionType": "git"
            },
            {
              "lessThan": "6cfae4914439878b8acb35c7e3b40096eeb2ad9c",
              "status": "affected",
              "version": "fe806e4992c9047affd263bcc13b2c047029a726",
              "versionType": "git"
            },
            {
              "lessThan": "1343a480f84b80c1249133a90ef87f8751d65cbb",
              "status": "affected",
              "version": "fe806e4992c9047affd263bcc13b2c047029a726",
              "versionType": "git"
            },
            {
              "lessThan": "7666dbb1bacc4ba522b96740cba7283d243d16e1",
              "status": "affected",
              "version": "fe806e4992c9047affd263bcc13b2c047029a726",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/scan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "lessThan": "5.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.142",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: advance loop vars in cfg80211_merge_profile()\n\ncfg80211_merge_profile() reassembles a Multi-BSSID non-transmitted BSS\nprofile that has been split across multiple consecutive MBSSID elements.\nIts while-loop calls\n\n\tcfg80211_get_profile_continuation(ie, ielen, mbssid_elem, sub_elem)\n\nbut never advances mbssid_elem or sub_elem inside the body.  Each\niteration therefore searches for a continuation that follows the same\nfixed pair; the helper returns the same next_mbssid; and the same\nnext_sub bytes are memcpy()\u0027d into merged_ie at a growing offset until\nthe buffer fills.\n\nAdvance both mbssid_elem and sub_elem to the just-consumed continuation\nso the next call to cfg80211_get_profile_continuation() searches for a\nfurther continuation beyond it (or returns NULL when none exists).\n\nA specially-crafted malicious beacon can take advantage of this bug\nto cause the kernel to spend an excessive amount of time in\ncfg80211_merge_profile (up to as much as 2ms per beacon received),\nwhich could theoretically be abused in some way."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-19T15:40:59.360Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5817e1e5205498a5df66eba2b34e817f4210fd0f"
        },
        {
          "url": "https://git.kernel.org/stable/c/cedbb608494ba1e7a5c6c56b7f1d3fd470094f28"
        },
        {
          "url": "https://git.kernel.org/stable/c/c0bc4c8bd556cbe036a5b9ed333c0aab9aadfcb8"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ced0f5a851f9cae274545a42a06c459b7fd8881"
        },
        {
          "url": "https://git.kernel.org/stable/c/67915715fd3874057457363c87c63e18829527df"
        },
        {
          "url": "https://git.kernel.org/stable/c/6cfae4914439878b8acb35c7e3b40096eeb2ad9c"
        },
        {
          "url": "https://git.kernel.org/stable/c/1343a480f84b80c1249133a90ef87f8751d65cbb"
        },
        {
          "url": "https://git.kernel.org/stable/c/7666dbb1bacc4ba522b96740cba7283d243d16e1"
        }
      ],
      "title": "wifi: cfg80211: advance loop vars in cfg80211_merge_profile()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64174",
    "datePublished": "2026-07-19T15:40:59.360Z",
    "dateReserved": "2026-07-19T07:54:57.039Z",
    "dateUpdated": "2026-07-19T15:40:59.360Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64174",
      "date": "2026-07-20",
      "epss": "0.00172",
      "percentile": "0.0688"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-64174\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-19T16:17:59.617\",\"lastModified\":\"2026-07-19T16:17:59.617\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: cfg80211: advance loop vars in cfg80211_merge_profile()\\n\\ncfg80211_merge_profile() reassembles a Multi-BSSID non-transmitted BSS\\nprofile that has been split across multiple consecutive MBSSID elements.\\nIts while-loop calls\\n\\n\\tcfg80211_get_profile_continuation(ie, ielen, mbssid_elem, sub_elem)\\n\\nbut never advances mbssid_elem or sub_elem inside the body.  Each\\niteration therefore searches for a continuation that follows the same\\nfixed pair; the helper returns the same next_mbssid; and the same\\nnext_sub bytes are memcpy()\u0027d into merged_ie at a growing offset until\\nthe buffer fills.\\n\\nAdvance both mbssid_elem and sub_elem to the just-consumed continuation\\nso the next call to cfg80211_get_profile_continuation() searches for a\\nfurther continuation beyond it (or returns NULL when none exists).\\n\\nA specially-crafted malicious beacon can take advantage of this bug\\nto cause the kernel to spend an excessive amount of time in\\ncfg80211_merge_profile (up to as much as 2ms per beacon received),\\nwhich could theoretically be abused in some way.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/wireless/scan.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"fe806e4992c9047affd263bcc13b2c047029a726\",\"lessThan\":\"5817e1e5205498a5df66eba2b34e817f4210fd0f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fe806e4992c9047affd263bcc13b2c047029a726\",\"lessThan\":\"cedbb608494ba1e7a5c6c56b7f1d3fd470094f28\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fe806e4992c9047affd263bcc13b2c047029a726\",\"lessThan\":\"c0bc4c8bd556cbe036a5b9ed333c0aab9aadfcb8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fe806e4992c9047affd263bcc13b2c047029a726\",\"lessThan\":\"1ced0f5a851f9cae274545a42a06c459b7fd8881\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fe806e4992c9047affd263bcc13b2c047029a726\",\"lessThan\":\"67915715fd3874057457363c87c63e18829527df\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fe806e4992c9047affd263bcc13b2c047029a726\",\"lessThan\":\"6cfae4914439878b8acb35c7e3b40096eeb2ad9c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fe806e4992c9047affd263bcc13b2c047029a726\",\"lessThan\":\"1343a480f84b80c1249133a90ef87f8751d65cbb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fe806e4992c9047affd263bcc13b2c047029a726\",\"lessThan\":\"7666dbb1bacc4ba522b96740cba7283d243d16e1\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/wireless/scan.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.258\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.209\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.175\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.142\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.92\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.34\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.11\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1343a480f84b80c1249133a90ef87f8751d65cbb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/1ced0f5a851f9cae274545a42a06c459b7fd8881\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5817e1e5205498a5df66eba2b34e817f4210fd0f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/67915715fd3874057457363c87c63e18829527df\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6cfae4914439878b8acb35c7e3b40096eeb2ad9c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7666dbb1bacc4ba522b96740cba7283d243d16e1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c0bc4c8bd556cbe036a5b9ed333c0aab9aadfcb8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cedbb608494ba1e7a5c6c56b7f1d3fd470094f28\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-20T10:36:13+00:00",
      "cve": "CVE-2026-64174",
      "id": "CVE-2026-64174",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: cfg80211: advance loop vars in cfg80211_merge_profile()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64174.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.