CVE-2026-64174

Analyzed Analyzed - Analysis Complete

Buffer Overflow in Linux Kernel WiFi Configuration

Publication date: 2026-07-19

Last updated on: 2026-08-13

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: advance loop vars in cfg80211_merge_profile() cfg80211_merge_profile() reassembles a Multi-BSSID non-transmitted BSS profile that has been split across multiple consecutive MBSSID elements. Its while-loop calls cfg80211_get_profile_continuation(ie, ielen, mbssid_elem, sub_elem) but never advances mbssid_elem or sub_elem inside the body. Each iteration therefore searches for a continuation that follows the same fixed pair; the helper returns the same next_mbssid; and the same next_sub bytes are memcpy()'d into merged_ie at a growing offset until the buffer fills. Advance both mbssid_elem and sub_elem to the just-consumed continuation so the next call to cfg80211_get_profile_continuation() searches for a further continuation beyond it (or returns NULL when none exists). A specially-crafted malicious beacon can take advantage of this bug to cause the kernel to spend an excessive amount of time in cfg80211_merge_profile (up to as much as 2ms per beacon received), which could theoretically be abused in some way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-08-13

Generated

2026-08-29

AI Q&A

2026-07-19

EPSS Evaluated

2026-08-28

NVD

CVE-2026-64174

EUVD

EUVD-2026-45859

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 5.16 (inc) to 6.1.175 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.209 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.92 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.34 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.11 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.142 (exc)
linux	linux_kernel	From 5.2 (inc) to 5.10.258 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's wifi configuration subsystem. It involves a flaw in the cfg80211_merge_profile() function which processes Multi-BSSID profiles split across multiple MBSSID elements. The function fails to advance loop variables when processing continuations, causing it to repeatedly process the same data until the buffer fills.

Detection Guidance

This vulnerability involves excessive processing in the Linux kernel's wifi configuration. Detection requires monitoring for abnormal CPU usage spikes during wireless network scanning or beacon processing. Check kernel logs for repeated calls to cfg80211_merge_profile() using commands like dmesg | grep cfg80211 or journalctl -k | grep cfg80211.

Impact Analysis

An attacker could exploit this by sending specially crafted malicious beacons. This could cause the kernel to spend excessive time processing these beacons, potentially up to 2ms per beacon. This could lead to denial-of-service conditions or system slowdowns.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a denial-of-service issue in the Linux kernel's WiFi configuration subsystem that could cause excessive CPU usage when processing malicious beacons. Compliance impact would only occur if such attacks disrupt systems handling sensitive data, but no direct regulatory impact is specified.

Mitigation Strategies

Apply the latest Linux kernel security updates immediately. If immediate patching isn't possible, disable MBSSID support by setting cfg80211.disable_4addr=1 as a temporary workaround. Monitor network traffic for malicious beacons and restrict access to wireless interfaces until patched.

Hi! I’m here to help you understand CVE-2026-64174. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70