Look up another CVE · open CVE-2026-64117 in the interactive tracker

CVE-2026-64117

wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb

8.8 EPSS 0.2% AV:A

Published 2026-07-19 (3 months ago) by the Linux kernel CNA. Subsystem net/mac80211. Debian urgency: unimportant.

What to do, per Debian release

Debian's own status for CVE-2026-64117 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source

Release	Status	Version	What this means
Debian 12bookworm	not affected	6.1.190-1	Nothing to do. bookworm never shipped the vulnerable code.
Debian 13trixie	vulnerable	6.12.113-1	No fix published anywhere yet, neither in Debian nor upstream for the series trixie tracks. Watch the Debian tracker page for this CVE. Advisories for trixie have historically landed a median of 11 days after publication.
Debian 14forky	fixed	7.0.12-1	Update the kernel and reboot. Fixed in 7.0.12-1. A running kernel keeps the old code until the machine restarts.
Debian unstablesid	fixed	7.0.12-1	Update the kernel and reboot. Fixed in 7.0.12-1. A running kernel keeps the old code until the machine restarts.

The vulnerability

What the bug is

ieee80211_invoke_fast_rx() reads RX status through IEEE80211_SKB_RXCB(skb), which aliases the same skb->cb storage that ieee80211_rx_mesh_data() reuses as IEEE80211_TX_INFO. In the unicast forward path, mesh_data does: info = IEEE80211_SKB_CB(fwd_skb); memset(info, 0, sizeof(*info)); on the same skb the caller still names via rx->skb, then either queues the skb for TX (success) or kfree_skb()'s it (no-route) before returning RX_QUEUED. The caller's RX_QUEUED arm then calls sta_stats_encode_rate(status) on memory that is either zeroed (success path) or freed (no-route path). The latter is KASAN slab-use-after-free in ieee80211_prepare_and_rx_handle. Fix by encoding the rate from status before invoking ieee80211_rx_mesh_data(), so the RX_QUEUED arm consumes a value captured while status was still backed by valid memory.

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

net/mac80211/rx.c

What this is: MAC80211MAINTAINERS section matched on net/mac80211/ · linux-wireless@vger.kernel.org · Maintained
Kernel module: mac80211

Check it on the machine

grep -w CONFIG_MAC80211 /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

lsmod | grep -w mac80211

Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.

Show whether Debian builds this, per release

Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.

bookwormMnot built on amd64/cloud-amd64, arm64/cloud-arm64
trixie, forky, sidMnot built on amd64/cloud-amd64, arm64/cloud-arm64, s390x/s390x

M: a module where it is built at all; some flavours do not build it

Build switch: CONFIG_MAC80211

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Debian tracker CVE record NVD kernel CNA record

Signals

Published: 2026-07-19 (3 months ago)source
CVSS: 8.8 high
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it
Attack vector: adjacent network (AV:A)source
EPSS: 0.25%, higher than 15.1% of all CVEssource
CISA KEV: not listedthe KEV catalogue
Debian urgency: unimportantsource
Subsystem: net/mac80211

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
6.4	6.18.57	a2650f8461cd
6.4	7.0.11	2fb64f94f9af
6.4	7.1	d71c841be5d9

Why the CNA scored it this way

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:AAttack vector, adjacent network: The bug is reached when mac80211 processes attacker-supplied 802.11 data frames received over WiFi in a mesh deployment; per kernel CNA guidance, WiFi frame delivery is Adjacent rather than fully remote Network.
AC:LAttack complexity, low: Once on a mesh network as an authorized peer, an attacker can reliably trigger the no-route unicast forward path by sending frames to destinations without an active mesh path, causing deterministic skb free followed by the UAF read.
PR:NPrivileges required, none: Exploitation requires no privileges on the victim host; the attacker only needs to transmit valid mesh data frames from an adjacent peer, not local root, capabilities, or namespace admin rights on the target system.
UI:NUser interaction, none: No victim user action is required beyond normal mesh operation; the bug fires automatically during RX processing of the attacker's frames.
S:UScope, unchanged: Impact is confined to kernel/mac80211 memory on the receiving system and does not cross a VM, container, or IOMMU security boundary.
C:HConfidentiality impact, high: The flaw is a slab use-after-free read of skb->cb via sta_stats_encode_rate(), which can expose freed heap contents and is classified as high confidentiality impact for UAF bugs.
I:HIntegrity impact, high: Use-after-free of skb control-block memory provides a standard heap corruption primitive that can be developed into arbitrary kernel writes or code execution, not merely a benign stats miscalculation.
A:HAvailability impact, high: The freed-skb path produces KASAN-reported slab use-after-free and can cause kernel oops or panic; the condition is repeatable by sending additional triggering frames for denial of service.