PT-2026-61434 · Linux · Linux

CVE-2026-64117

·

Publicado

2026-07-19

·

Atualizado

2026-07-19

CVSS v3.1

8.8

Alta

VetorAV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb
ieee80211 invoke fast rx() reads RX status through IEEE80211 SKB RXCB(skb), which aliases the same skb->cb storage that ieee80211 rx mesh data() reuses as IEEE80211 TX INFO. In the unicast forward path, mesh data does:
info = IEEE80211 SKB CB(fwd skb);
memset(info, 0, sizeof(*info));
on the same skb the caller still names via rx->skb, then either queues the skb for TX (success) or kfree skb()'s it (no-route) before returning RX QUEUED. The caller's RX QUEUED arm then calls sta stats encode rate(status) on memory that is either zeroed (success path) or freed (no-route path). The latter is KASAN slab-use-after-free in ieee80211 prepare and rx handle.
Fix by encoding the rate from status before invoking ieee80211 rx mesh data(), so the RX QUEUED arm consumes a value captured while status was still backed by valid memory.

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-2026-64117

Produtos afetados

Linux