Vulnerability-Lookup

FKIE_CVE-2026-68470

Vulnerability from fkie_nvd - Published: 2026-08-15 06:19 - Updated: 2026-08-17 06:17

Severity

8.8 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate extension-frame layout before RX Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can still reach helpers and interface dispatch code that read regular header address fields before unsupported extension subtypes are dropped. mac80211 currently only handles S1G beacon extension frames. Drop other extension subtypes before they can reach regular-header RX processing. For S1G beacons, linearize the SKB with the management-frame path and require the fixed S1G beacon header, including optional fixed fields indicated by frame control, before generic RX dispatch. Route S1G beacons through the station/default-link RX path without regular-header station lookup. Avoid regular-header address reads in the mac80211 RX paths that process S1G extension beacons, including accept-frame, duplicate-detection, address-copy, and MLO address-translation paths. Also make ieee80211_get_bssid() length-safe before returning the S1G source-address pointer.

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/57d503ce32eccfa7650065ca4c560f7e29a2e676
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/625fc704b19cb48d7d269ad54ffffb4d3bf9c7ed

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/rx.c",
            "net/mac80211/util.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "625fc704b19cb48d7d269ad54ffffb4d3bf9c7ed",
              "status": "affected",
              "version": "09a740ce352e1a1d16b9984115514ba9a4f4704b",
              "versionType": "git"
            },
            {
              "lessThan": "57d503ce32eccfa7650065ca4c560f7e29a2e676",
              "status": "affected",
              "version": "09a740ce352e1a1d16b9984115514ba9a4f4704b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/rx.c",
            "net/mac80211/util.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: validate extension-frame layout before RX\n\nExtension frames only have the extension header at the regular 802.11\nheader offset. The generic RX path can still reach helpers and interface\ndispatch code that read regular header address fields before unsupported\nextension subtypes are dropped.\n\nmac80211 currently only handles S1G beacon extension frames. Drop other\nextension subtypes before they can reach regular-header RX processing.\nFor S1G beacons, linearize the SKB with the management-frame path and\nrequire the fixed S1G beacon header, including optional fixed fields\nindicated by frame control, before generic RX dispatch.\n\nRoute S1G beacons through the station/default-link RX path without\nregular-header station lookup. Avoid regular-header address reads in the\nmac80211 RX paths that process S1G extension beacons, including\naccept-frame, duplicate-detection, address-copy, and MLO\naddress-translation paths.\n\nAlso make ieee80211_get_bssid() length-safe before returning the S1G\nsource-address pointer."
    }
  ],
  "id": "CVE-2026-68470",
  "lastModified": "2026-08-17T06:17:56.400",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-08-15T06:19:57.767",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/57d503ce32eccfa7650065ca4c560f7e29a2e676"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/625fc704b19cb48d7d269ad54ffffb4d3bf9c7ed"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

CVE-2026-68470 (GCVE-0-2026-68470)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:51 – Updated: 2026-08-17 05:39

Title

wifi: mac80211: validate extension-frame layout before RX

Summary

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

2 references

URL	Tags
https://git.kernel.org/stable/c/625fc704b19cb48d7…
https://git.kernel.org/stable/c/57d503ce32eccfa76…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 09a740ce352e1a1d16b9984115514ba9a4f4704b , < 625fc704b19cb48d7d269ad54ffffb4d3bf9c7ed (git) Affected: 09a740ce352e1a1d16b9984115514ba9a4f4704b , < 57d503ce32eccfa7650065ca4c560f7e29a2e676 (git)
Linux	Linux	Affected: 5.10 Unaffected: 0 , < 5.10 (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/rx.c",
            "net/mac80211/util.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "625fc704b19cb48d7d269ad54ffffb4d3bf9c7ed",
              "status": "affected",
              "version": "09a740ce352e1a1d16b9984115514ba9a4f4704b",
              "versionType": "git"
            },
            {
              "lessThan": "57d503ce32eccfa7650065ca4c560f7e29a2e676",
              "status": "affected",
              "version": "09a740ce352e1a1d16b9984115514ba9a4f4704b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/rx.c",
            "net/mac80211/util.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: validate extension-frame layout before RX\n\nExtension frames only have the extension header at the regular 802.11\nheader offset. The generic RX path can still reach helpers and interface\ndispatch code that read regular header address fields before unsupported\nextension subtypes are dropped.\n\nmac80211 currently only handles S1G beacon extension frames. Drop other\nextension subtypes before they can reach regular-header RX processing.\nFor S1G beacons, linearize the SKB with the management-frame path and\nrequire the fixed S1G beacon header, including optional fixed fields\nindicated by frame control, before generic RX dispatch.\n\nRoute S1G beacons through the station/default-link RX path without\nregular-header station lookup. Avoid regular-header address reads in the\nmac80211 RX paths that process S1G extension beacons, including\naccept-frame, duplicate-detection, address-copy, and MLO\naddress-translation paths.\n\nAlso make ieee80211_get_bssid() length-safe before returning the S1G\nsource-address pointer."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - Malformed 802.11 extension/S1G frames reach mac80211 via the normal WiFi RX path (driver -\u003e ieee80211_rx_list -\u003e __ieee80211_rx_handle_packet); an attacker within radio range can inject frames over the air without routing through the Internet.\nAC:L - The attacker fully controls crafted extension-frame length, subtype, and frame-control flags; only 4 bytes are validated before code reads up to 24 bytes of presumed 802.11 addresses, so triggering the bug is reliable and does not depend on victim-specific timing or memory layout.\nPR:N - Exploitation requires only transmitting WiFi frames to a victim with an active mac80211 interface; no local account, capability, or association/authentication is needed because vulnerable header parsing runs before extension subtype filtering and RX handler dispatch.\nUI:N - The victim does not need to click links, join networks, or perform any deliberate action beyond having WiFi enabled; passive reception of attacker-injected extension frames on AP, STA, or mesh interfaces is sufficient to reach the vulnerable code.\nS:U - Impact is confined to kernel mac80211 RX processing on the receiving host (OOB skb reads/writes and possible crash/privilege escalation); it does not cross a VM, container, or IOMMU security boundary into another authority.\nC:H - Pre-fix code reads regular-header addr1/addr2/addr3/seq_ctrl and copies 18 bytes of addrs on extension frames whose layout differs and may be shorter than 24 bytes, causing out-of-bounds reads and disclosure of adjacent skb/heap memory via ieee80211_get_bssid(), accept-frame, duplicate detection, and MLO prep paths.\nI:H - ieee80211_prepare_and_rx_handle can perform ether_addr_copy() MLO address translation on S1G/extension frames because ieee80211_is_beacon() is false for FTYPE_EXT, writing attacker-influenced MAC bytes into wrong skb offsets and enabling memory corruption that could be developed into arbitrary kernel write/code execution.\nA:H - Out-of-bounds access while parsing short or malformed extension frames can provoke kernel oops/panic or destabilize RX processing; even failed exploitation still enables repeatable remote DoS against any reachable WiFi interface by retransmitting malicious extension frames."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:39:12.948Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/625fc704b19cb48d7d269ad54ffffb4d3bf9c7ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/57d503ce32eccfa7650065ca4c560f7e29a2e676"
        }
      ],
      "title": "wifi: mac80211: validate extension-frame layout before RX",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68470",
    "datePublished": "2026-08-15T05:51:28.211Z",
    "dateReserved": "2026-07-30T09:28:09.396Z",
    "dateUpdated": "2026-08-17T05:39:12.948Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

FKIE_CVE-2026-68470

CVE-2026-68470 (GCVE-0-2026-68470)

Tags

Sightings

Nomenclature