{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/ieee80211-eht.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "90576bd6921a91eb038bffbb4b9467c2dc26aa1d",
              "status": "affected",
              "version": "0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada1",
              "versionType": "git"
            },
            {
              "lessThan": "2b1589fd9a076727a73bfb39e96622a76415ad32",
              "status": "affected",
              "version": "0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada1",
              "versionType": "git"
            },
            {
              "lessThan": "293baeae9b2434a3e432629d7720b5603db2d77e",
              "status": "affected",
              "version": "0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/ieee80211-eht.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ieee80211: validate MLE common info length\n\nieee80211_mle_common_size() uses the first common-info octet as the\ncommon information length for all known MLE types. However,\nieee80211_mle_size_ok() only validates that octet for Basic, Probe\nRequest, and TDLS MLEs.\n\nReconfiguration MLEs also skipped the length octet when calculating the\nminimum common size, and Priority Access MLEs skipped validation of the\nadvertised common information length.\n\nAccount for the Reconfiguration common-info length octet and validate\nthe advertised common information length for all known MLE types. Keep\nunknown-type handling unchanged.\n\n[remove now misleading comment]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - Reachable by transmitting crafted 802.11 management frames (probe responses, beacons, protected EHT action frames) over WiFi; the mac80211/cfg80211 stack parses Multi-Link Elements on receive without requiring local access.\nAC:L - An adjacent attacker fully controls the MLE common-info length octet in forged frames and can reliably pass ieee80211_mle_size_ok() with an inflated value, triggering deterministic out-of-bounds parsing during routine scan or beacon processing.\nPR:N - No local privileges or association are required; a rogue AP or frame injector can deliver malicious MLEs to any scanning or MLD-associated station via standard pre-authentication WiFi management traffic.\nUI:N - Exploitation requires only passive reception of attacker-supplied WiFi frames during background scanning or normal beacon/action-frame handling; no victim interaction beyond having WiFi enabled.\nS:U - Impact is kernel heap out-of-bounds access within the WiFi stack on the victim host; it does not cross a VM, IOMMU, or sandbox security boundary to another authority.\nC:H - Inflated common_len makes ieee80211_mle_common_size() exceed the element buffer, causing for_each_element/cfg80211_defragment_element to read beyond the skb or kmalloc allocation, enabling unbounded kernel memory disclosure.\nI:H - The length underflow and out-of-bounds element iteration constitute exploitable kernel memory corruption; subsequent defragmentation and nested ie parsing can leverage corrupted pointers for arbitrary write primitives.\nA:H - Out-of-bounds reads of unmapped or non-element memory during MLE sub-element iteration can trigger a kernel oops or panic, remotely denying service to any WiFi-enabled device in range."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:39:14.035Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/90576bd6921a91eb038bffbb4b9467c2dc26aa1d"
        },
        {
          "url": "https://git.kernel.org/stable/c/2b1589fd9a076727a73bfb39e96622a76415ad32"
        },
        {
          "url": "https://git.kernel.org/stable/c/293baeae9b2434a3e432629d7720b5603db2d77e"
        }
      ],
      "title": "wifi: ieee80211: validate MLE common info length",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68471",
    "datePublished": "2026-08-15T05:51:29.001Z",
    "dateReserved": "2026-07-30T09:28:09.396Z",
    "dateUpdated": "2026-08-17T05:39:14.035Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}