CVE-2026-53182

Analyzed Analyzed - Analysis Complete

Buffer Overflow in Linux Kernel WiFi Subsystem

Publication date: 2026-06-25

Last updated on: 2026-07-06

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: reject oversized EMA RNR lists nl80211_parse_rnr_elems() stores the parsed element count in a u8-backed cfg80211_rnr_elems::cnt field and uses that count to size the flexible array allocation. Reject nested NL80211_ATTR_EMA_RNR_ELEMS input once the count reaches 255, before incrementing it again. This keeps the parser aligned with the data structure it fills and matches the existing bound check used by nl80211_parse_mbssid_elems().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-25

Last Modified

2026-07-06

Generated

2026-07-15

AI Q&A

2026-06-25

EPSS Evaluated

2026-07-14

NVD

CVE-2026-53182

EUVD

EUVD-2026-39273

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.13 (inc) to 6.18.36 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.94 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.13 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.4 (inc) to 6.6.143 (exc)
linux	linux_kernel	From 6.1.160 (inc) to 6.1.176 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's wifi subsystem, specifically in the nl80211 component that handles wireless configuration.

The issue involves the function nl80211_parse_rnr_elems(), which parses certain elements related to EMA RNR (Extended Measurement Advertisement Reduced Neighbor Report) lists.

The function stores the count of parsed elements in an 8-bit unsigned integer field (u8), which limits the count to a maximum of 255.

If the input contains nested NL80211_ATTR_EMA_RNR_ELEMS elements that cause the count to exceed 255, the parser could become misaligned with the data structure it is filling.

The vulnerability is addressed by rejecting any nested EMA RNR elements once the count reaches 255, preventing the count from incrementing beyond this limit and maintaining proper alignment and bounds checking.

Impact Analysis

If exploited, this vulnerability could cause the nl80211 parser in the Linux kernel to become misaligned with the data it processes.

Such misalignment could potentially lead to memory corruption, unexpected behavior, or crashes in the wifi subsystem.

This could affect the stability and security of systems running vulnerable Linux kernels, especially those relying on wireless networking.

Hi! I’m here to help you understand CVE-2026-53182. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70