CVE-2026-53182
Received Received - Intake
Buffer Overflow in Linux Kernel WiFi Subsystem

Publication date: 2026-06-25

Last updated on: 2026-06-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: reject oversized EMA RNR lists nl80211_parse_rnr_elems() stores the parsed element count in a u8-backed cfg80211_rnr_elems::cnt field and uses that count to size the flexible array allocation. Reject nested NL80211_ATTR_EMA_RNR_ELEMS input once the count reaches 255, before incrementing it again. This keeps the parser aligned with the data structure it fills and matches the existing bound check used by nl80211_parse_mbssid_elems().
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-25
Last Modified
2026-06-25
Generated
2026-06-25
AI Q&A
2026-06-25
EPSS Evaluated
N/A
NVD
CVE-2026-53182
EUVD
EUVD-2026-39273
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Linux kernel's wifi subsystem, specifically in the nl80211 component that handles wireless configuration.

The issue involves the function nl80211_parse_rnr_elems(), which parses certain elements related to EMA RNR (Extended Measurement Advertisement Reduced Neighbor Report) lists.

The function stores the count of parsed elements in an 8-bit unsigned integer field (u8), which limits the count to a maximum of 255.

If the input contains nested NL80211_ATTR_EMA_RNR_ELEMS elements that cause the count to exceed 255, the parser could become misaligned with the data structure it is filling.

The vulnerability is addressed by rejecting any nested EMA RNR elements once the count reaches 255, preventing the count from incrementing beyond this limit and maintaining proper alignment and bounds checking.

Impact Analysis

If exploited, this vulnerability could cause the nl80211 parser in the Linux kernel to become misaligned with the data it processes.

Such misalignment could potentially lead to memory corruption, unexpected behavior, or crashes in the wifi subsystem.

This could affect the stability and security of systems running vulnerable Linux kernels, especially those relying on wireless networking.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53182. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart