{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/rx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2fb64f94f9afb774f2fa0c7835727d7a67f89f07",
              "status": "affected",
              "version": "3468e1e0c639032a603450f0830ccabfa76f5806",
              "versionType": "git"
            },
            {
              "lessThan": "d71c841be5d9e586ee7f36c0dc8ed4db0d9a1349",
              "status": "affected",
              "version": "3468e1e0c639032a603450f0830ccabfa76f5806",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mac80211/rx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: capture fast-RX rate before mesh reuses skb-\u003ecb\n\nieee80211_invoke_fast_rx() reads RX status through\nIEEE80211_SKB_RXCB(skb), which aliases the same skb-\u003ecb storage\nthat ieee80211_rx_mesh_data() reuses as IEEE80211_TX_INFO.  In the\nunicast forward path, mesh_data does:\n\n\tinfo = IEEE80211_SKB_CB(fwd_skb);\n\tmemset(info, 0, sizeof(*info));\n\non the same skb the caller still names via rx-\u003eskb, then either\nqueues the skb for TX (success) or kfree_skb()\u0027s it (no-route)\nbefore returning RX_QUEUED.  The caller\u0027s RX_QUEUED arm then\ncalls sta_stats_encode_rate(status) on memory that is either\nzeroed (success path) or freed (no-route path).  The latter is\nKASAN slab-use-after-free in ieee80211_prepare_and_rx_handle.\n\nFix by encoding the rate from status before invoking\nieee80211_rx_mesh_data(), so the RX_QUEUED arm consumes a value\ncaptured while status was still backed by valid memory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The bug is reached when mac80211 processes attacker-supplied 802.11 data frames received over WiFi in a mesh deployment; per kernel CNA guidance, WiFi frame delivery is Adjacent rather than fully remote Network.\nAC:L - Once on a mesh network as an authorized peer, an attacker can reliably trigger the no-route unicast forward path by sending frames to destinations without an active mesh path, causing deterministic skb free followed by the UAF read.\nPR:N - Exploitation requires no privileges on the victim host; the attacker only needs to transmit valid mesh data frames from an adjacent peer, not local root, capabilities, or namespace admin rights on the target system.\nUI:N - No victim user action is required beyond normal mesh operation; the bug fires automatically during RX processing of the attacker\u0027s frames.\nS:U - Impact is confined to kernel/mac80211 memory on the receiving system and does not cross a VM, container, or IOMMU security boundary.\nC:H - The flaw is a slab use-after-free read of skb-\u003ecb via sta_stats_encode_rate(), which can expose freed heap contents and is classified as high confidentiality impact for UAF bugs.\nI:H - Use-after-free of skb control-block memory provides a standard heap corruption primitive that can be developed into arbitrary kernel writes or code execution, not merely a benign stats miscalculation.\nA:H - The freed-skb path produces KASAN-reported slab use-after-free and can cause kernel oops or panic; the condition is repeatable by sending additional triggering frames for denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:39:26.505Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2fb64f94f9afb774f2fa0c7835727d7a67f89f07"
        },
        {
          "url": "https://git.kernel.org/stable/c/d71c841be5d9e586ee7f36c0dc8ed4db0d9a1349"
        }
      ],
      "title": "wifi: mac80211: capture fast-RX rate before mesh reuses skb-\u003ecb",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64117",
    "datePublished": "2026-07-19T15:40:16.941Z",
    "dateReserved": "2026-07-19T07:54:57.035Z",
    "dateUpdated": "2026-08-05T12:39:26.505Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}