CVE-2026-64030
Received Received - Intake

Bounds-check failure in mac80211 link_id handling

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs IEEE80211_MLE_STA_EPCS_CONTROL_LINK_ID is 0x000f, so link_id extracted from a PRIO_ACCESS ML element PER_STA_PROFILE subelement can be 0..15. sdata->link[] has IEEE80211_MLD_MAX_NUM_LINKS (15) entries (indices 0..14), making index 15 out-of-bounds. A connected WiFi 7 AP can trigger this by sending an EPCS Enable Response action frame with a PER_STA_PROFILE subelement where link_id = 15. The unsolicited-notification path (dialog_token = 0) is reachable any time EPCS is already enabled, without any prior client request. sdata->link[15] reads into the first word of sdata->activate_links_work (a wiphy_work whose embedded list_head is non-NULL after INIT_LIST_HEAD), so the NULL check on the result does not catch the invalid access. The garbage pointer is then passed to ieee80211_sta_wmm_params(), which dereferences link->sdata and crashes the kernel. The same class of bug was fixed for ieee80211_ml_reconfiguration() by commit 162d331d833d ("wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration").

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64030
EUVD
EUVD-2026-45603

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a buffer overflow vulnerability in the Linux kernel's WiFi subsystem. It occurs when processing a malformed WiFi 7 Access Point frame that contains an out-of-bounds link_id value. The kernel fails to validate this value properly, leading to an invalid memory access that can crash the system.

Detection Guidance

This vulnerability is specific to the Linux kernel's WiFi 7 implementation and requires kernel-level detection. Monitor kernel logs for crashes or errors related to mac80211 or WiFi 7 functionality. Check for unexpected behavior in WiFi connections or AP interactions. No direct commands are provided in the context to detect this issue.

Impact Analysis

An attacker within WiFi range could exploit this to crash the vulnerable system by sending a specially crafted frame. This causes a kernel panic, resulting in denial of service. Systems using affected Linux kernel versions with WiFi 7 support are vulnerable.

Compliance Impact

This vulnerability is a kernel memory corruption issue in the Linux WiFi subsystem that could lead to system crashes. It does not directly relate to data privacy or compliance with standards like GDPR or HIPAA, as it is not a data exposure or access control flaw.

Mitigation Strategies

Apply the latest Linux kernel updates that include the fix for this vulnerability. If using a vulnerable kernel version, avoid using WiFi 7 features or disable them until patched. Monitor vendor advisories for kernel updates addressing this issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64030. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart