PT-2026-61347 · Linux · Linux
CVE-2026-64030
·
Published
2026-07-19
·
Updated
2026-07-19
CVSS v3.1
8.8
High
| Vector | AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: bounds-check link id in ieee80211 ml epcs
IEEE80211 MLE STA EPCS CONTROL LINK ID is 0x000f, so link id extracted
from a PRIO ACCESS ML element PER STA PROFILE subelement can be 0..15.
sdata->link[] has IEEE80211 MLD MAX NUM LINKS (15) entries (indices 0..14),
making index 15 out-of-bounds.
A connected WiFi 7 AP can trigger this by sending an EPCS Enable Response
action frame with a PER STA PROFILE subelement where link id = 15. The
unsolicited-notification path (dialog token = 0) is reachable any time
EPCS is already enabled, without any prior client request.
sdata->link[15] reads into the first word of sdata->activate links work
(a wiphy work whose embedded list head is non-NULL after INIT LIST HEAD),
so the NULL check on the result does not catch the invalid access. The
garbage pointer is then passed to ieee80211 sta wmm params(), which
dereferences link->sdata and crashes the kernel.
The same class of bug was fixed for ieee80211 ml reconfiguration() by
commit 162d331d833d ("wifi: mac80211: bounds-check link id in
ieee80211 ml reconfiguration").
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux