CVE-2026-64223
Received Received - Intake

Buffer Overflow in Linux Kernel WiFi Subsystem

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: consume only present negotiated TTLM maps ieee80211_tid_to_link_map_size_ok() validates negotiated TTLM elements against the number of link-map entries indicated by link_map_presence. ieee80211_parse_neg_ttlm() must consume the same layout. The parser advanced its cursor for every TID, including TIDs whose presence bit is clear and therefore have no map bytes in the element. A sparse map can then make a later present TID read past the validated element. The bad bytes land in neg_ttlm->{up,down}link[tid] but are gated by valid_links before being applied to driver state, so a peer cannot turn the read into a policy change. Under KUnit + KASAN with an exact-sized element allocation the OOB read is reported as a slab-out-of-bounds; whether the same trigger fires under the production RX path depends on surrounding allocator state. Advance the cursor only when the current TID has a map present.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-24
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-64223
EUVD
EUVD-2026-48631

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves incorrect handling of TTLM (Transmit Link Metrics) maps in the mac80211 subsystem. The parser reads more bytes than intended by advancing its cursor for every TID (Traffic Identifier), even when the presence bit indicates no map bytes exist. This can lead to an out-of-bounds read, potentially exposing memory or causing crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's mac80211 subsystem and may not have direct detection commands. It involves an out-of-bounds read in TTLM map parsing. Monitoring kernel logs for slab-out-of-bounds errors or unusual WiFi driver behavior may indicate exploitation. Check kernel logs with 'dmesg | grep -i slab' or 'journalctl -k | grep -i oob'.

Impact Analysis

The impact is limited due to safeguards. The out-of-bounds read only affects internal driver state if valid_links permits it, and a peer cannot exploit it to change policy. Under specific testing conditions (KUnit + KASAN), it may trigger a slab-out-of-bounds error, but real-world exploitation is unlikely.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel memory safety issue without documented impact on data protection or privacy controls.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for CVE-2026-64223. If immediate patching is not possible, consider disabling vulnerable WiFi features or restricting network access to untrusted peers until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64223. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart