CVE-2026-64223

Analyzed Analyzed - Analysis Complete

Buffer Overflow in Linux Kernel WiFi Subsystem

Publication date: 2026-07-24

Last updated on: 2026-08-12

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: consume only present negotiated TTLM maps ieee80211_tid_to_link_map_size_ok() validates negotiated TTLM elements against the number of link-map entries indicated by link_map_presence. ieee80211_parse_neg_ttlm() must consume the same layout. The parser advanced its cursor for every TID, including TIDs whose presence bit is clear and therefore have no map bytes in the element. A sparse map can then make a later present TID read past the validated element. The bad bytes land in neg_ttlm->{up,down}link[tid] but are gated by valid_links before being applied to driver state, so a peer cannot turn the read into a policy change. Under KUnit + KASAN with an exact-sized element allocation the OOB read is reported as a slab-out-of-bounds; whether the same trigger fires under the production RX path depends on surrounding allocator state. Advance the cursor only when the current TID has a map present.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-24

Last Modified

2026-08-12

Generated

2026-08-14

AI Q&A

2026-07-24

EPSS Evaluated

2026-08-12

NVD

CVE-2026-64223

EUVD

EUVD-2026-48631

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.13 (inc) to 6.18.34 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.11 (exc)
linux	linux_kernel	From 6.9 (inc) to 6.12.92 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves incorrect handling of TTLM (Transmit Link Metrics) maps in the mac80211 subsystem. The parser reads more bytes than intended by advancing its cursor for every TID (Traffic Identifier), even when the presence bit indicates no map bytes exist. This can lead to an out-of-bounds read, potentially exposing memory or causing crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's mac80211 subsystem and may not have direct detection commands. It involves an out-of-bounds read in TTLM map parsing. Monitoring kernel logs for slab-out-of-bounds errors or unusual WiFi driver behavior may indicate exploitation. Check kernel logs with 'dmesg | grep -i slab' or 'journalctl -k | grep -i oob'.

Impact Analysis

The impact is limited due to safeguards. The out-of-bounds read only affects internal driver state if valid_links permits it, and a peer cannot exploit it to change policy. Under specific testing conditions (KUnit + KASAN), it may trigger a slab-out-of-bounds error, but real-world exploitation is unlikely.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel memory safety issue without documented impact on data protection or privacy controls.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for CVE-2026-64223. If immediate patching is not possible, consider disabling vulnerable WiFi features or restricting network access to untrusted peers until the update is applied.

Hi! I’m here to help you understand CVE-2026-64223. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70