PT-2026-61434 · Linux · Linux
CVE-2026-64117
·
Published
2026-07-19
·
Updated
2026-07-19
CVSS v3.1
8.8
High
| Vector | AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb
ieee80211 invoke fast rx() reads RX status through
IEEE80211 SKB RXCB(skb), which aliases the same skb->cb storage
that ieee80211 rx mesh data() reuses as IEEE80211 TX INFO. In the
unicast forward path, mesh data does:
info = IEEE80211 SKB CB(fwd skb);
memset(info, 0, sizeof(*info));on the same skb the caller still names via rx->skb, then either
queues the skb for TX (success) or kfree skb()'s it (no-route)
before returning RX QUEUED. The caller's RX QUEUED arm then
calls sta stats encode rate(status) on memory that is either
zeroed (success path) or freed (no-route path). The latter is
KASAN slab-use-after-free in ieee80211 prepare and rx handle.
Fix by encoding the rate from status before invoking
ieee80211 rx mesh data(), so the RX QUEUED arm consumes a value
captured while status was still backed by valid memory.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux