Local Privilege Escalation in wpa_supplicant

Executive Summary

CVE-2026-78807 is a flaw in wpa_supplicant versions before v2.12 where a local attacker can bypass network context and AKMP matching for PMKSA caching. The issue occurs due to missing validation in the driver-based PMKSA selection path, allowing an attacker to trick the system into using an unrelated PMKSA entry during key establishment.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the version of wpa_supplicant on your system. Run 'wpa_supplicant -v' to see the installed version. If it is below v2.12, the system is vulnerable. Additionally, monitor network authentication logs for unusual PMKSA caching behavior or mismatched network contexts during key establishment.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to bypass authentication steps for a network, potentially gaining unauthorized access. While valid credentials are still required for any configured network, the flaw enables misuse of PMKSA entries established via SAE to attack other networks using WPA2-PSK or WPA2/WPA3-Enterprise.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update wpa_supplicant to version 2.12 or later. If updating is not possible, apply the specific commit mentioned in the security advisory. Ensure network context and AKMP matching rules are enforced for PMKSA entry acceptance. Avoid using vulnerable configurations for WPA2-Personal or WPA2/WPA3-Enterprise networks.

Useful 0 Not Useful 0