GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-68470 (GCVE-0-2026-68470)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:51 – Updated: 2026-08-17 05:39
VLAI
Title
wifi: mac80211: validate extension-frame layout before RX
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate extension-frame layout before RX Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can still reach helpers and interface dispatch code that read regular header address fields before unsupported extension subtypes are dropped. mac80211 currently only handles S1G beacon extension frames. Drop other extension subtypes before they can reach regular-header RX processing. For S1G beacons, linearize the SKB with the management-frame path and require the fixed S1G beacon header, including optional fixed fields indicated by frame control, before generic RX dispatch. Route S1G beacons through the station/default-link RX path without regular-header station lookup. Avoid regular-header address reads in the mac80211 RX paths that process S1G extension beacons, including accept-frame, duplicate-detection, address-copy, and MLO address-translation paths. Also make ieee80211_get_bssid() length-safe before returning the S1G source-address pointer.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 09a740ce352e1a1d16b9984115514ba9a4f4704b , < 625fc704b19cb48d7d269ad54ffffb4d3bf9c7ed (git)
Affected: 09a740ce352e1a1d16b9984115514ba9a4f4704b , < 57d503ce32eccfa7650065ca4c560f7e29a2e676 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.10
Unaffected: 0 , < 5.10 (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/rx.c",
            "net/mac80211/util.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "625fc704b19cb48d7d269ad54ffffb4d3bf9c7ed",
              "status": "affected",
              "version": "09a740ce352e1a1d16b9984115514ba9a4f4704b",
              "versionType": "git"
            },
            {
              "lessThan": "57d503ce32eccfa7650065ca4c560f7e29a2e676",
              "status": "affected",
              "version": "09a740ce352e1a1d16b9984115514ba9a4f4704b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/rx.c",
            "net/mac80211/util.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: validate extension-frame layout before RX\n\nExtension frames only have the extension header at the regular 802.11\nheader offset. The generic RX path can still reach helpers and interface\ndispatch code that read regular header address fields before unsupported\nextension subtypes are dropped.\n\nmac80211 currently only handles S1G beacon extension frames. Drop other\nextension subtypes before they can reach regular-header RX processing.\nFor S1G beacons, linearize the SKB with the management-frame path and\nrequire the fixed S1G beacon header, including optional fixed fields\nindicated by frame control, before generic RX dispatch.\n\nRoute S1G beacons through the station/default-link RX path without\nregular-header station lookup. Avoid regular-header address reads in the\nmac80211 RX paths that process S1G extension beacons, including\naccept-frame, duplicate-detection, address-copy, and MLO\naddress-translation paths.\n\nAlso make ieee80211_get_bssid() length-safe before returning the S1G\nsource-address pointer."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - Malformed 802.11 extension/S1G frames reach mac80211 via the normal WiFi RX path (driver -\u003e ieee80211_rx_list -\u003e __ieee80211_rx_handle_packet); an attacker within radio range can inject frames over the air without routing through the Internet.\nAC:L - The attacker fully controls crafted extension-frame length, subtype, and frame-control flags; only 4 bytes are validated before code reads up to 24 bytes of presumed 802.11 addresses, so triggering the bug is reliable and does not depend on victim-specific timing or memory layout.\nPR:N - Exploitation requires only transmitting WiFi frames to a victim with an active mac80211 interface; no local account, capability, or association/authentication is needed because vulnerable header parsing runs before extension subtype filtering and RX handler dispatch.\nUI:N - The victim does not need to click links, join networks, or perform any deliberate action beyond having WiFi enabled; passive reception of attacker-injected extension frames on AP, STA, or mesh interfaces is sufficient to reach the vulnerable code.\nS:U - Impact is confined to kernel mac80211 RX processing on the receiving host (OOB skb reads/writes and possible crash/privilege escalation); it does not cross a VM, container, or IOMMU security boundary into another authority.\nC:H - Pre-fix code reads regular-header addr1/addr2/addr3/seq_ctrl and copies 18 bytes of addrs on extension frames whose layout differs and may be shorter than 24 bytes, causing out-of-bounds reads and disclosure of adjacent skb/heap memory via ieee80211_get_bssid(), accept-frame, duplicate detection, and MLO prep paths.\nI:H - ieee80211_prepare_and_rx_handle can perform ether_addr_copy() MLO address translation on S1G/extension frames because ieee80211_is_beacon() is false for FTYPE_EXT, writing attacker-influenced MAC bytes into wrong skb offsets and enabling memory corruption that could be developed into arbitrary kernel write/code execution.\nA:H - Out-of-bounds access while parsing short or malformed extension frames can provoke kernel oops/panic or destabilize RX processing; even failed exploitation still enables repeatable remote DoS against any reachable WiFi interface by retransmitting malicious extension frames."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:39:12.948Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/625fc704b19cb48d7d269ad54ffffb4d3bf9c7ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/57d503ce32eccfa7650065ca4c560f7e29a2e676"
        }
      ],
      "title": "wifi: mac80211: validate extension-frame layout before RX",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68470",
    "datePublished": "2026-08-15T05:51:28.211Z",
    "dateReserved": "2026-07-30T09:28:09.396Z",
    "dateUpdated": "2026-08-17T05:39:12.948Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68470",
      "date": "2026-09-05",
      "epss": "0.00289",
      "percentile": "0.21093"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-23T14:42:43.000Z",
      "cve": "CVE-2026-68470",
      "id": "msrc_CVE-2026-68470",
      "initial_release_date": "2026-08-23T14:42:43.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "wifi: mac80211: validate extension-frame layout before RX",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-68470.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68470\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:19:57.767\",\"lastModified\":\"2026-08-17T06:17:56.400\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: mac80211: validate extension-frame layout before RX\\n\\nExtension frames only have the extension header at the regular 802.11\\nheader offset. The generic RX path can still reach helpers and interface\\ndispatch code that read regular header address fields before unsupported\\nextension subtypes are dropped.\\n\\nmac80211 currently only handles S1G beacon extension frames. Drop other\\nextension subtypes before they can reach regular-header RX processing.\\nFor S1G beacons, linearize the SKB with the management-frame path and\\nrequire the fixed S1G beacon header, including optional fixed fields\\nindicated by frame control, before generic RX dispatch.\\n\\nRoute S1G beacons through the station/default-link RX path without\\nregular-header station lookup. Avoid regular-header address reads in the\\nmac80211 RX paths that process S1G extension beacons, including\\naccept-frame, duplicate-detection, address-copy, and MLO\\naddress-translation paths.\\n\\nAlso make ieee80211_get_bssid() length-safe before returning the S1G\\nsource-address pointer.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/mac80211/rx.c\",\"net/mac80211/util.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"09a740ce352e1a1d16b9984115514ba9a4f4704b\",\"lessThan\":\"625fc704b19cb48d7d269ad54ffffb4d3bf9c7ed\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"09a740ce352e1a1d16b9984115514ba9a4f4704b\",\"lessThan\":\"57d503ce32eccfa7650065ca4c560f7e29a2e676\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/mac80211/rx.c\",\"net/mac80211/util.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/57d503ce32eccfa7650065ca4c560f7e29a2e676\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/625fc704b19cb48d7d269ad54ffffb4d3bf9c7ed\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-17T14:36:49+00:00",
      "cve": "CVE-2026-68470",
      "id": "CVE-2026-68470",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "28",
      "product_status:under_investigation": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: mac80211: validate extension-frame layout before RX",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68470.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.