GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-68472 (GCVE-0-2026-68472)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:51 – Updated: 2026-08-17 05:39
VLAI
Title
wifi: cfg80211: validate EHT MLE before MLD ID read
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate EHT MLE before MLD ID read cfg80211_gen_new_ie() copies ML probe response elements from the parent frame when the parent EHT multi-link element has an MLD ID matching the nontransmitted BSSID index. The code only checked that the extension element had more than one byte before calling ieee80211_mle_get_mld_id(). That helper assumes a BASIC MLE with enough common info and documents that callers must first use ieee80211_mle_type_ok(). Attack chain: malicious AP sends a short EHT MLE in an MBSSID beacon. cfg80211_inform_bss_frame_data() stores the copied IE buffer. cfg80211_parse_mbssid_data() builds the nontransmitted BSS IE. cfg80211_gen_new_ie() sees the EHT MLE in the parent frame. ieee80211_mle_get_mld_id() then reads past the IE boundary. Validate the MLE type and size before reading the MLD ID. This matches the contract required by the MLE helper and rejects the short element before any internal MLE fields are accessed.
Severity
8.1 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 61dcfa8c2a8f6c53ce77b2c832b82990754b2aa9 , < 584657c5fc58d7a840623a2fa06331c9661dd0f1 (git)
Affected: 61dcfa8c2a8f6c53ce77b2c832b82990754b2aa9 , < 3b0505e43da8fb5b2a7994c3c3604e5a74692154 (git)
Affected: 61dcfa8c2a8f6c53ce77b2c832b82990754b2aa9 , < 74e27cd1d98b546fdb276008a83708d062339661 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/scan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "584657c5fc58d7a840623a2fa06331c9661dd0f1",
              "status": "affected",
              "version": "61dcfa8c2a8f6c53ce77b2c832b82990754b2aa9",
              "versionType": "git"
            },
            {
              "lessThan": "3b0505e43da8fb5b2a7994c3c3604e5a74692154",
              "status": "affected",
              "version": "61dcfa8c2a8f6c53ce77b2c832b82990754b2aa9",
              "versionType": "git"
            },
            {
              "lessThan": "74e27cd1d98b546fdb276008a83708d062339661",
              "status": "affected",
              "version": "61dcfa8c2a8f6c53ce77b2c832b82990754b2aa9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/scan.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: validate EHT MLE before MLD ID read\n\ncfg80211_gen_new_ie() copies ML probe response elements from\nthe parent frame when the parent EHT multi-link element has an\nMLD ID matching the nontransmitted BSSID index.\n\nThe code only checked that the extension element had more than\none byte before calling ieee80211_mle_get_mld_id(). That helper\nassumes a BASIC MLE with enough common info and documents that\ncallers must first use ieee80211_mle_type_ok().\n\nAttack chain:\nmalicious AP sends a short EHT MLE in an MBSSID beacon.\ncfg80211_inform_bss_frame_data() stores the copied IE buffer.\ncfg80211_parse_mbssid_data() builds the nontransmitted BSS IE.\ncfg80211_gen_new_ie() sees the EHT MLE in the parent frame.\nieee80211_mle_get_mld_id() then reads past the IE boundary.\n\nValidate the MLE type and size before reading the MLD ID. This\nmatches the contract required by the MLE helper and rejects the\nshort element before any internal MLE fields are accessed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - A malicious AP within Wi-Fi radio range can send a crafted MBSSID beacon with a truncated EHT Multi-Link element; cfg80211_inform_bss_frame_data() processes it on scanning or associated STAs without routable network access.\nAC:L - The attacker fully controls beacon IE layout, MLE control/presence bits, and the nontransmitted BSSID index, deterministically triggering ieee80211_mle_get_mld_id() past the element boundary without races or memory-layout luck.\nPR:N - Beacon and MBSSID parsing run before authentication or association on the automatic RX path; no victim credentials, local account, or kernel capability is required to deliver the malformed frame.\nUI:N - Stations automatically receive and process beacons during periodic background, scheduled, and connected-mode scanning without any user action beyond normal Wi-Fi operation.\nS:U - The out-of-bounds read and any resulting fault occur entirely within the host kernel security authority; no VM, IOMMU, container, or sandbox boundary is crossed.\nC:H - ieee80211_mle_get_mld_id() walks attacker-controlled optional MLE fields and reads past the truncated element into adjacent skb or kernel memory beyond the declared IE length, enabling kernel memory disclosure.\nI:N - The defect is an out-of-bounds read used only to compare an MLD ID before optional element copying; it does not perform out-of-bounds writes or provide a control-flow or arbitrary-write primitive.\nA:H - Reads past the receive buffer can fault under KASAN/KFENCE or hit unmapped memory, and a rogue AP can retransmit crafted beacons indefinitely to repeatedly trigger kernel oops or panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:39:15.119Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/584657c5fc58d7a840623a2fa06331c9661dd0f1"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b0505e43da8fb5b2a7994c3c3604e5a74692154"
        },
        {
          "url": "https://git.kernel.org/stable/c/74e27cd1d98b546fdb276008a83708d062339661"
        }
      ],
      "title": "wifi: cfg80211: validate EHT MLE before MLD ID read",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68472",
    "datePublished": "2026-08-15T05:51:29.634Z",
    "dateReserved": "2026-07-30T09:28:09.396Z",
    "dateUpdated": "2026-08-17T05:39:15.119Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68472",
      "date": "2026-09-05",
      "epss": "0.00298",
      "percentile": "0.22078"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68472\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:20:05.570\",\"lastModified\":\"2026-08-17T06:17:56.620\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nwifi: cfg80211: validate EHT MLE before MLD ID read\\n\\ncfg80211_gen_new_ie() copies ML probe response elements from\\nthe parent frame when the parent EHT multi-link element has an\\nMLD ID matching the nontransmitted BSSID index.\\n\\nThe code only checked that the extension element had more than\\none byte before calling ieee80211_mle_get_mld_id(). That helper\\nassumes a BASIC MLE with enough common info and documents that\\ncallers must first use ieee80211_mle_type_ok().\\n\\nAttack chain:\\nmalicious AP sends a short EHT MLE in an MBSSID beacon.\\ncfg80211_inform_bss_frame_data() stores the copied IE buffer.\\ncfg80211_parse_mbssid_data() builds the nontransmitted BSS IE.\\ncfg80211_gen_new_ie() sees the EHT MLE in the parent frame.\\nieee80211_mle_get_mld_id() then reads past the IE boundary.\\n\\nValidate the MLE type and size before reading the MLD ID. This\\nmatches the contract required by the MLE helper and rejects the\\nshort element before any internal MLE fields are accessed.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/wireless/scan.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"61dcfa8c2a8f6c53ce77b2c832b82990754b2aa9\",\"lessThan\":\"584657c5fc58d7a840623a2fa06331c9661dd0f1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"61dcfa8c2a8f6c53ce77b2c832b82990754b2aa9\",\"lessThan\":\"3b0505e43da8fb5b2a7994c3c3604e5a74692154\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"61dcfa8c2a8f6c53ce77b2c832b82990754b2aa9\",\"lessThan\":\"74e27cd1d98b546fdb276008a83708d062339661\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/wireless/scan.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.40\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3b0505e43da8fb5b2a7994c3c3604e5a74692154\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/584657c5fc58d7a840623a2fa06331c9661dd0f1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/74e27cd1d98b546fdb276008a83708d062339661\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-17T15:28:32+00:00",
      "cve": "CVE-2026-68472",
      "id": "CVE-2026-68472",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: wifi: cfg80211: validate EHT MLE before MLD ID read",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68472.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.