CVE-2026-68402

Received Received - Intake

Out-of-Bounds Read in Linux Kernel WiFi Subsystem

Publication date: 2026-08-10

Last updated on: 2026-08-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: bound element ID read when checking non-inheritance cfg80211_is_element_inherited() reads the first data octet of the candidate element (id = elem->data[0]) to look it up in an extension non-inheritance list. It does so after testing elem->id, but without verifying that the element actually has a data octet. A zero-length extension element (WLAN_EID_EXTENSION with length 0) therefore makes it read one octet past the end of the element. _ieee802_11_parse_elems_full() runs this check for every element of a frame once a non-inheritance context exists -- e.g. while parsing a per-STA profile of a Multi-Link element in a (re)association response, or a non-transmitted BSS profile -- so a crafted frame from an AP can trigger a one-octet slab-out-of-bounds read during element parsing: BUG: KASAN: slab-out-of-bounds in cfg80211_is_element_inherited Read of size 1 ... in net/wireless/scan.c Return early (treat the element as inherited) when an extension element carries no data, mirroring the existing handling of empty ID lists. The bug was found by fuzzing ieee802_11_parse_elems_full() under KASAN.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-19

Generated

2026-08-30

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-68402

EUVD

EUVD-2026-55588

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a memory corruption vulnerability in the Linux kernel's wifi configuration subsystem. It occurs when parsing wireless frames where an extension element has zero length. The function cfg80211_is_element_inherited() tries to read the first data octet of such an element without checking if data exists, causing it to read one octet past the end of the element.

Detection Guidance

This vulnerability is a kernel memory corruption issue triggered by malformed WiFi frames. Detection requires kernel logging or fuzzing tools. Check kernel logs for KASAN slab-out-of-bounds errors after WiFi frame parsing. Use tools like Wireshark to capture and analyze WiFi frames for malformed elements. No direct commands detect it without prior exploitation attempts.

Impact Analysis

This vulnerability could allow a remote attacker to cause a kernel memory corruption by sending a specially crafted wireless frame. This may lead to system crashes, denial of service, or potentially privilege escalation if exploited successfully.

Compliance Impact

This vulnerability is a low-level memory corruption issue in the Linux kernel's WiFi configuration subsystem. It does not directly impact compliance with standards like GDPR or HIPAA, as those focus on data protection, privacy, and security controls rather than kernel memory safety.

Mitigation Strategies

Apply the latest Linux kernel security patches immediately. Disable WiFi interfaces if untrusted networks are used. Monitor kernel logs for slab-out-of-bounds errors. Restrict access to WiFi networks until patched. Update wireless drivers and firmware to versions containing the fix.

Hi! I’m here to help you understand CVE-2026-68402. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70