Look up another CVE · open CVE-2026-68402 in the interactive tracker
CVE-2026-68402
wifi: cfg80211: bound element ID read when checking non-inheritance
Published 2026-08-10 (2 months ago) by the Linux kernel CNA. Subsystem net/wireless. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-68402 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4777-1 · 2026-09-08 · text | 6.1.187-1 | Update the kernel and reboot. DLA-4777-1 shipped the fix on 2026-09-08, in 6.1.187-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.101-1 | Update the kernel and reboot. Fixed in 6.12.101-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.6-1 | Update the kernel and reboot. Fixed in 7.1.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.6-1 | Update the kernel and reboot. Fixed in 7.1.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4745-1 · 2026-08-18 · text | 6.12.101-1~deb12u1 | Update the kernel and reboot. DLA-4745-1 shipped the fix on 2026-08-18, in 6.12.101-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
cfg80211_is_element_inherited() reads the first data octet of the candidate element (id = elem->data[0]) to look it up in an extension non-inheritance list. It does so after testing elem->id, but without verifying that the element actually has a data octet. A zero-length extension element (WLAN_EID_EXTENSION with length 0) therefore makes it read one octet past the end of the element. _ieee802_11_parse_elems_full() runs this check for every element of a frame once a non-inheritance context exists -- e.g. while parsing a per-STA profile of a Multi-Link element in a (re)association response, or a non-transmitted BSS profile -- so a crafted frame from an AP can trigger a one-octet slab-out-of-bounds read during element parsing: BUG: KASAN: slab-out-of-bounds in cfg80211_is_element_inherited Read of size 1 ... in net/wireless/scan.c Return early (treat the element as inherited) when an extension element carries no data, mirroring the existing handling of empty ID lists. The bug was found by fuzzing ieee802_11_parse_elems_full() under KASAN.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/wireless/scan.c
- What this is
- 802.11 (including CFG80211/NL80211)MAINTAINERS section matched on net/wireless/ · linux-wireless@vger.kernel.org · Maintained
- Kernel module
- cfg80211
Check it on the machine
grep -wE 'CONFIG_CFG80211|CONFIG_WIRELESS' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w cfg80211Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookwormMnot built on amd64/cloud-amd64, arm64/cloud-arm64
- trixie, forky, sidMnot built on amd64/cloud-amd64, arm64/cloud-arm64, s390x/s390x
- bookworm · linux-6.12Mnot built on amd64/cloud-amd64, arm64/cloud-arm64
- M
- a module where it is built at all; some flavours do not build it
- Build switches
- CONFIG_CFG80211, CONFIG_WIRELESS
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-10 (2 months ago)source
- CVSS
- 7.1 high
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Hsource recompute it - Attack vector
- adjacent network (AV:A)source
- EPSS
- 0.27%, higher than 17.2% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- net/wireless
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.2 | 5.10.265 | 521dd5fe6d12 |
| 5.2 | 5.15.216 | 24154c172246 |
| 5.2 | 6.1.183 | 2d31ebb26a14 |
| 5.2 | 6.6.148 | 20c308d9a577 |
| 5.2 | 6.12.101 | 84bd907361c5 |
| 5.2 | 6.18.42 | 11ac7a5e75f5 |
| 5.2 | 7.1.6 | ddf2773bcc8e |
| 5.2 | 7.2 | cb8afea4655f |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4777-1 | 2026-09-08 | bookworm 6.1.187-1 | tracker |
| DLA-4745-1 | 2026-08-18 | bookworm 6.12.101-1~deb12u1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:AAttack vector, adjacent network
- The malformed element arrives in an 802.11 management frame (beacon, probe response, ML probe response or (re)association response) processed by mac80211's element parser, so the attacker must be a rogue/spoofing AP within radio range of the victim station.
- AC:LAttack complexity, low
- The attacker fully controls the frame contents and simply appends a zero-length WLAN_EID_EXTENSION element inside a frame that already establishes a non-inheritance context (multi-BSSID non-transmitted profile or a Multi-Link per-STA profile), which reliably triggers the over-read every time.
- PR:NPrivileges required, none
- Beacons, probe responses and association responses are parsed before or independently of any authentication or key establishment, so an unauthenticated attacker with no credentials on the network can deliver the crafted frame.
- UI:NUser interaction, none
- Stations parse beacons and probe/association responses automatically as part of scanning, roaming and staying associated; no action by the device owner is needed for the crafted frame to be processed.
- S:UScope, unchanged
- The out-of-bounds read stays within the kernel's own memory and security authority; no other component or privilege domain is crossed.
- C:LConfidentiality impact, low
- The read is a single octet past the end of the slab object, and its value is only compared against the non-inheritance ID list, influencing whether an element is parsed — this leaks at most a narrow side-channel oracle about one adjacent heap byte rather than arbitrary memory.
- I:NIntegrity impact, none
- The defect is purely a read; no kernel memory is written or corrupted, and the only consequence is a possibly wrong inherit/skip decision for one element in a frame the attacker already controls.
- A:HAvailability impact, high
- The slab out-of-bounds access is fatal on KASAN, hardened or debug-allocator kernels (the bug was reported as a KASAN slab-out-of-bounds splat), and can be re-triggered at will by an adjacent unauthenticated attacker to repeatedly panic the machine.