Look up another CVE · open CVE-2026-68472 in the interactive tracker
CVE-2026-68472
wifi: cfg80211: validate EHT MLE before MLD ID read
Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem net/wireless. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-68472 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | not affected | 6.12.113-1 | Nothing to do. trixie never shipped the vulnerable code. |
| Debian 14forky | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
cfg80211_gen_new_ie() copies ML probe response elements from the parent frame when the parent EHT multi-link element has an MLD ID matching the nontransmitted BSSID index. The code only checked that the extension element had more than one byte before calling ieee80211_mle_get_mld_id(). That helper assumes a BASIC MLE with enough common info and documents that callers must first use ieee80211_mle_type_ok(). Attack chain: malicious AP sends a short EHT MLE in an MBSSID beacon. cfg80211_inform_bss_frame_data() stores the copied IE buffer. cfg80211_parse_mbssid_data() builds the nontransmitted BSS IE. cfg80211_gen_new_ie() sees the EHT MLE in the parent frame. ieee80211_mle_get_mld_id() then reads past the IE boundary. Validate the MLE type and size before reading the MLD ID. This matches the contract required by the MLE helper and rejects the short element before any internal MLE fields are accessed.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/wireless/scan.c
- What this is
- 802.11 (including CFG80211/NL80211)MAINTAINERS section matched on net/wireless/ · linux-wireless@vger.kernel.org · Maintained
- Kernel module
- cfg80211
Check it on the machine
grep -wE 'CONFIG_CFG80211|CONFIG_WIRELESS' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w cfg80211Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookwormMnot built on amd64/cloud-amd64, arm64/cloud-arm64
- trixie, forky, sidMnot built on amd64/cloud-amd64, arm64/cloud-arm64, s390x/s390x
- M
- a module where it is built at all; some flavours do not build it
- Build switches
- CONFIG_CFG80211, CONFIG_WIRELESS
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-15 (2 months ago)source
- CVSS
- 8.1 high
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Hsource recompute it - Attack vector
- adjacent network (AV:A)source
- EPSS
- 0.34%, higher than 26.2% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- net/wireless
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.14 | 6.18.40 | 584657c5fc58 |
| 6.14 | 7.1.5 | 3b0505e43da8 |
| 6.14 | 7.2 | 74e27cd1d98b |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:AAttack vector, adjacent network
- A malicious AP within Wi-Fi radio range can send a crafted MBSSID beacon with a truncated EHT Multi-Link element; cfg80211_inform_bss_frame_data() processes it on scanning or associated STAs without routable network access.
- AC:LAttack complexity, low
- The attacker fully controls beacon IE layout, MLE control/presence bits, and the nontransmitted BSSID index, deterministically triggering ieee80211_mle_get_mld_id() past the element boundary without races or memory-layout luck.
- PR:NPrivileges required, none
- Beacon and MBSSID parsing run before authentication or association on the automatic RX path; no victim credentials, local account, or kernel capability is required to deliver the malformed frame.
- UI:NUser interaction, none
- Stations automatically receive and process beacons during periodic background, scheduled, and connected-mode scanning without any user action beyond normal Wi-Fi operation.
- S:UScope, unchanged
- The out-of-bounds read and any resulting fault occur entirely within the host kernel security authority; no VM, IOMMU, container, or sandbox boundary is crossed.
- C:HConfidentiality impact, high
- ieee80211_mle_get_mld_id() walks attacker-controlled optional MLE fields and reads past the truncated element into adjacent skb or kernel memory beyond the declared IE length, enabling kernel memory disclosure.
- I:NIntegrity impact, none
- The defect is an out-of-bounds read used only to compare an MLD ID before optional element copying; it does not perform out-of-bounds writes or provide a control-flow or arbitrary-write primitive.
- A:HAvailability impact, high
- Reads past the receive buffer can fault under KASAN/KFENCE or hit unmapped memory, and a rogue AP can retransmit crafted beacons indefinitely to repeatedly trigger kernel oops or panic.