CVE-2026-68472

Received Received - Intake

Buffer Overflow in Linux Kernel WiFi Configuration

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate EHT MLE before MLD ID read cfg80211_gen_new_ie() copies ML probe response elements from the parent frame when the parent EHT multi-link element has an MLD ID matching the nontransmitted BSSID index. The code only checked that the extension element had more than one byte before calling ieee80211_mle_get_mld_id(). That helper assumes a BASIC MLE with enough common info and documents that callers must first use ieee80211_mle_type_ok(). Attack chain: malicious AP sends a short EHT MLE in an MBSSID beacon. cfg80211_inform_bss_frame_data() stores the copied IE buffer. cfg80211_parse_mbssid_data() builds the nontransmitted BSS IE. cfg80211_gen_new_ie() sees the EHT MLE in the parent frame. ieee80211_mle_get_mld_id() then reads past the IE boundary. Validate the MLE type and size before reading the MLD ID. This matches the contract required by the MLE helper and rejects the short element before any internal MLE fields are accessed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-68472

EUVD

EUVD-2026-59094

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper validation of EHT (Extremely High Throughput) Multi-Link Element (MLE) in wifi configuration. A malicious access point (AP) can send a short EHT MLE in a beacon frame. The kernel's cfg80211 module incorrectly copies this element without proper validation, leading to reading past the intended buffer boundary when extracting the MLD ID. This occurs because the code assumes the MLE is valid without first checking its type and size.

Detection Guidance

This vulnerability involves a flaw in the Linux kernel's wifi configuration where a malicious access point (AP) can send a short EHT MLE in an MBSSID beacon. Detection requires monitoring for malformed or unusually short EHT MLE frames in network traffic. Use tools like Wireshark to capture and analyze beacon frames for EHT MLE elements. Check kernel logs for warnings related to cfg80211 or wifi driver errors.

Impact Analysis

This vulnerability could allow an attacker within wireless range to cause a denial of service (DoS) by crashing the system or potentially executing arbitrary code on affected Linux systems. It may also enable unauthorized access to sensitive information if exploited successfully.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level Linux kernel issue related to WiFi configuration. It may indirectly impact compliance if exploited to compromise network integrity, but no direct regulatory impact is described.

Mitigation Strategies

Immediately update your Linux kernel to the latest stable version that includes the fix for this vulnerability. If updating is not immediately possible, consider disabling MBSSID functionality if it is not required. Monitor vendor advisories for patches and apply them as soon as they become available.

Hi! I’m here to help you understand CVE-2026-68472. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70