CVE-2026-64515

Received Received - Intake

Heap Buffer Overrun in Linux Kernel WiFi MLE Defragmentation

Publication date: 2026-07-25

Last updated on: 2026-07-27

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix MLE defragmentation If either reconf or EPCS multi-link element (MLE) is contained in a non-transmitted profile, the defragmentation routine is called with a pointer to the defragmented copy, but the original elements. This is incorrect for two reasons: - if the original defragmentation was needed, it will not find the correct data - if the original frame is at a higher address, the parsing will potentially overrun the heap data (though given the layout of the buffers, only into the new defragmentation buffer, and then it has to stop and fail once that's filled with copied data. Fix it by tracking the container along with the pointer and in doing so also unify the two almost identical defragmentation routines.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-07-27

Generated

2026-08-14

AI Q&A

2026-07-25

EPSS Evaluated

2026-08-13

NVD

CVE-2026-64515

EUVD

EUVD-2026-48859

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves incorrect handling of multi-link element (MLE) defragmentation in the wifi subsystem. When certain elements like reconf or EPCS MLE are in a non-transmitted profile, the defragmentation routine uses a pointer to the defragmented copy but the original elements, leading to incorrect data access or potential heap buffer overruns.

Detection Guidance

This vulnerability is specific to the Linux kernel's wifi subsystem and involves incorrect defragmentation of MLE elements. Detection requires checking kernel logs for related errors or examining the kernel version for unpatched systems. Commands like 'dmesg | grep mac80211' or 'uname -a' may help identify affected systems.

Impact Analysis

This flaw could allow an attacker to cause memory corruption or crashes in the Linux kernel by exploiting incorrect defragmentation logic. This may lead to denial-of-service conditions or potentially unauthorized access if exploited successfully.

Compliance Impact

This vulnerability affects compliance with standards and regulations like GDPR and HIPAA only if the affected system processes or transmits protected health information (PHI) or personal data over Wi-Fi networks. The flaw could lead to data corruption or unauthorized access during Wi-Fi communication, potentially violating confidentiality requirements in GDPR and HIPAA.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the MLE defragmentation issue in mac80211.

Hi! I’m here to help you understand CVE-2026-64515. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70