Look up another CVE · open CVE-2026-64223 in the interactive tracker

CVE-2026-64223

wifi: mac80211: consume only present negotiated TTLM maps

8.1 EPSS 0.4% AV:A

Published 2026-07-24 (3 months ago) by the Linux kernel CNA. Subsystem net/mac80211. Debian urgency: unimportant.

What to do, per Debian release

Debian's own status for CVE-2026-64223 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source

Release	Status	Version	What this means
Debian 12bookworm	not affected	6.1.190-1	Nothing to do. bookworm never shipped the vulnerable code.
Debian 13trixie	fixed	6.12.94-1	Update the kernel and reboot. Fixed in 6.12.94-1. A running kernel keeps the old code until the machine restarts.
Debian 14forky	fixed	7.0.12-1	Update the kernel and reboot. Fixed in 7.0.12-1. A running kernel keeps the old code until the machine restarts.
Debian unstablesid	fixed	7.0.12-1	Update the kernel and reboot. Fixed in 7.0.12-1. A running kernel keeps the old code until the machine restarts.

The vulnerability

What the bug is

ieee80211_tid_to_link_map_size_ok() validates negotiated TTLM elements against the number of link-map entries indicated by link_map_presence. ieee80211_parse_neg_ttlm() must consume the same layout. The parser advanced its cursor for every TID, including TIDs whose presence bit is clear and therefore have no map bytes in the element. A sparse map can then make a later present TID read past the validated element. The bad bytes land in neg_ttlm->{up,down}link[tid] but are gated by valid_links before being applied to driver state, so a peer cannot turn the read into a policy change. Under KUnit + KASAN with an exact-sized element allocation the OOB read is reported as a slab-out-of-bounds; whether the same trigger fires under the production RX path depends on surrounding allocator state. Advance the cursor only when the current TID has a map present.

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

net/mac80211/mlme.c

What this is: MAC80211MAINTAINERS section matched on net/mac80211/ · linux-wireless@vger.kernel.org · Maintained
Kernel module: mac80211

Check it on the machine

grep -w CONFIG_MAC80211 /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

lsmod | grep -w mac80211

Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.

Show whether Debian builds this, per release

Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.

bookwormMnot built on amd64/cloud-amd64, arm64/cloud-arm64
trixie, forky, sidMnot built on amd64/cloud-amd64, arm64/cloud-arm64, s390x/s390x

M: a module where it is built at all; some flavours do not build it

Build switch: CONFIG_MAC80211

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Debian tracker CVE record NVD kernel CNA record

Signals

Published: 2026-07-24 (3 months ago)source
CVSS: 8.1 high
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Hsource recompute it
Attack vector: adjacent network (AV:A)source
EPSS: 0.39%, higher than 31.0% of all CVEssource
CISA KEV: not listedthe KEV catalogue
Debian urgency: unimportantsource
Subsystem: net/mac80211

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
6.9	6.12.92	f7d395dc5008
6.9	6.18.34	2dd9304727c7
6.9	7.0.11	2becaaeebe23
6.9	7.1	a6e6ccd5bd07

Why the CNA scored it this way

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:AAttack vector, adjacent network: A malicious or spoofed Wi-Fi 7 MLO peer can trigger the parser using an over-the-air Protected EHT TTLM request, requiring radio-network adjacency.
AC:LAttack complexity, low: A crafted sparse link_map_presence deterministically causes the invalid cursor advancement and OOB read; no race or condition outside the attacker’s control is required to reach the flaw.
PR:NPrivileges required, none: The attacker needs no local account, capability, or target-system privilege; an associated malicious AP/MLD peer can supply the frame.
UI:NUser interaction, none: Once the station is connected to the malicious or compromised AP, the crafted management frame is processed automatically without user action.
S:UScope, unchanged: The vulnerable parser and resulting impacts remain within the host kernel’s existing security authority and do not cross a VM, IOMMU, or sandbox boundary.
C:HConfidentiality impact, high: Sparse maps cause multiple one- or two-byte reads beyond the validated element into surrounding kernel allocation state. Applying the required higher-severity choice for an OOB kernel read, potential disclosure of adjacent kernel memory is scored High.
I:NIntegrity impact, none: All writes remain within the bounded neg_ttlm arrays, and parsed link values are checked against valid_links before driver-state application; there is no OOB write or control-flow corruption primitive.
A:HAvailability impact, high: An exact-sized allocation produces a KASAN slab-out-of-bounds report, which can panic sanitizer-enabled kernels, and the peer can repeatedly send the trigger. Although production behavior depends on RX-buffer allocation state, the required higher-severity choice supports High.