CVE-2026-64223 (GCVE-0-2026-64223)
Vulnerability from cvelistv5
Published
2026-07-24 15:23
Modified
2026-08-05 12:40
Severity ?
8.1 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: consume only present negotiated TTLM maps ieee80211_tid_to_link_map_size_ok() validates negotiated TTLM elements against the number of link-map entries indicated by link_map_presence. ieee80211_parse_neg_ttlm() must consume the same layout. The parser advanced its cursor for every TID, including TIDs whose presence bit is clear and therefore have no map bytes in the element. A sparse map can then make a later present TID read past the validated element. The bad bytes land in neg_ttlm->{up,down}link[tid] but are gated by valid_links before being applied to driver state, so a peer cannot turn the read into a policy change. Under KUnit + KASAN with an exact-sized element allocation the OOB read is reported as a slab-out-of-bounds; whether the same trigger fires under the production RX path depends on surrounding allocator state. Advance the cursor only when the current TID has a map present.
References
Impacted products
Vendor Product Version
Linux Linux Version: 8f500fbc6c655976c8062b1f1e55bd0b3095d6c2
Version: 8f500fbc6c655976c8062b1f1e55bd0b3095d6c2
Version: 8f500fbc6c655976c8062b1f1e55bd0b3095d6c2
Version: 8f500fbc6c655976c8062b1f1e55bd0b3095d6c2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/mlme.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f7d395dc5008168ac5b9c1ac2791e59a6078cca1",
              "status": "affected",
              "version": "8f500fbc6c655976c8062b1f1e55bd0b3095d6c2",
              "versionType": "git"
            },
            {
              "lessThan": "2dd9304727c7041df0a599595910bdbe02ad03c5",
              "status": "affected",
              "version": "8f500fbc6c655976c8062b1f1e55bd0b3095d6c2",
              "versionType": "git"
            },
            {
              "lessThan": "2becaaeebe230ade1fcd5d0f1cde4d6ee93ec78f",
              "status": "affected",
              "version": "8f500fbc6c655976c8062b1f1e55bd0b3095d6c2",
              "versionType": "git"
            },
            {
              "lessThan": "a6e6ccd5bd07155c2add6c74ce1a5e68ad3b95ea",
              "status": "affected",
              "version": "8f500fbc6c655976c8062b1f1e55bd0b3095d6c2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/mlme.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: consume only present negotiated TTLM maps\n\nieee80211_tid_to_link_map_size_ok() validates negotiated TTLM elements\nagainst the number of link-map entries indicated by link_map_presence.\nieee80211_parse_neg_ttlm() must consume the same layout.\n\nThe parser advanced its cursor for every TID, including TIDs whose\npresence bit is clear and therefore have no map bytes in the element.\nA sparse map can then make a later present TID read past the validated\nelement.\n\nThe bad bytes land in neg_ttlm-\u003e{up,down}link[tid] but are gated by\nvalid_links before being applied to driver state, so a peer cannot\nturn the read into a policy change.  Under KUnit + KASAN with an\nexact-sized element allocation the OOB read is reported as a\nslab-out-of-bounds; whether the same trigger fires under the\nproduction RX path depends on surrounding allocator state.\n\nAdvance the cursor only when the current TID has a map present."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - A malicious or spoofed Wi-Fi 7 MLO peer can trigger the parser using an over-the-air Protected EHT TTLM request, requiring radio-network adjacency.\nAC:L - A crafted sparse link_map_presence deterministically causes the invalid cursor advancement and OOB read; no race or condition outside the attacker\u2019s control is required to reach the flaw.\nPR:N - The attacker needs no local account, capability, or target-system privilege; an associated malicious AP/MLD peer can supply the frame.\nUI:N - Once the station is connected to the malicious or compromised AP, the crafted management frame is processed automatically without user action.\nS:U - The vulnerable parser and resulting impacts remain within the host kernel\u2019s existing security authority and do not cross a VM, IOMMU, or sandbox boundary.\nC:H - Sparse maps cause multiple one- or two-byte reads beyond the validated element into surrounding kernel allocation state. Applying the required higher-severity choice for an OOB kernel read, potential disclosure of adjacent kernel memory is scored High.\nI:N - All writes remain within the bounded neg_ttlm arrays, and parsed link values are checked against valid_links before driver-state application; there is no OOB write or control-flow corruption primitive.\nA:H - An exact-sized allocation produces a KASAN slab-out-of-bounds report, which can panic sanitizer-enabled kernels, and the peer can repeatedly send the trigger. Although production behavior depends on RX-buffer allocation state, the required higher-severity choice supports High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:40:10.599Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f7d395dc5008168ac5b9c1ac2791e59a6078cca1"
        },
        {
          "url": "https://git.kernel.org/stable/c/2dd9304727c7041df0a599595910bdbe02ad03c5"
        },
        {
          "url": "https://git.kernel.org/stable/c/2becaaeebe230ade1fcd5d0f1cde4d6ee93ec78f"
        },
        {
          "url": "https://git.kernel.org/stable/c/a6e6ccd5bd07155c2add6c74ce1a5e68ad3b95ea"
        }
      ],
      "title": "wifi: mac80211: consume only present negotiated TTLM maps",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64223",
    "datePublished": "2026-07-24T15:23:08.629Z",
    "dateReserved": "2026-07-19T15:36:31.770Z",
    "dateUpdated": "2026-08-05T12:40:10.599Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.