Riskcovery

CVE-2026-23246

wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration

State
Published
Severity
8.8 High
Published
Mar 18, 2026
Updated
Aug 5, 2026
Reserved
Jan 13, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration

link_id is taken from the ML Reconfiguration element (control & 0x000f), so it can be 0..15. link_removal_timeout[] has IEEE80211_MLD_MAX_NUM_LINKS (15) elements, so index 15 is out-of-bounds. Skip subelements with link_id >= IEEE80211_MLD_MAX_NUM_LINKS to avoid a stack out-of-bounds write.

Scores

CVSSScoreVectorSource
3.18.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 8eb8dd2ffbbb6b0b8843b66754ee9f129f1b2d6c to before 650981e718e68005ca2760a6358134b8a98ebea4Affected
  • 8eb8dd2ffbbb6b0b8843b66754ee9f129f1b2d6c to before bfde158d5d1322c0c2df398a8d1ccce04943be2eAffected
  • 8eb8dd2ffbbb6b0b8843b66754ee9f129f1b2d6c to before f35ceec54d48e227fa46f8f97fd100a77b8eab15Affected
  • 8eb8dd2ffbbb6b0b8843b66754ee9f129f1b2d6c to before d58d71c2167601762351962b9604808d3be94400Affected
  • 8eb8dd2ffbbb6b0b8843b66754ee9f129f1b2d6c to before 162d331d833dc73a3e905a24c44dd33732af1fc5Affected
LinuxLinux
  • 6.5Affected
  • before 6.5Not affected
  • 6.6.130 through 6.6.*Not affected
  • 6.12.77 through 6.12.*Not affected
  • 6.18.17 through 6.18.*Not affected
  • 6.19.7 through 6.19.*Not affected
  • 7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.