Vulnerability-Lookup

GHSA-Q4HH-8FM2-F5VW

Vulnerability from github – Published: 2026-08-15 06:32 – Updated: 2026-08-17 06:33

Details

In the Linux kernel, the following vulnerability has been resolved:

wifi: ieee80211: validate MLE common info length

ieee80211_mle_common_size() uses the first common-info octet as the common information length for all known MLE types. However, ieee80211_mle_size_ok() only validates that octet for Basic, Probe Request, and TDLS MLEs.

Reconfiguration MLEs also skipped the length octet when calculating the minimum common size, and Priority Access MLEs skipped validation of the advertised common information length.

Account for the Reconfiguration common-info length octet and validate the advertised common information length for all known MLE types. Keep unknown-type handling unchanged.

[remove now misleading comment]

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-68471"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-15T06:20:05Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ieee80211: validate MLE common info length\n\nieee80211_mle_common_size() uses the first common-info octet as the\ncommon information length for all known MLE types. However,\nieee80211_mle_size_ok() only validates that octet for Basic, Probe\nRequest, and TDLS MLEs.\n\nReconfiguration MLEs also skipped the length octet when calculating the\nminimum common size, and Priority Access MLEs skipped validation of the\nadvertised common information length.\n\nAccount for the Reconfiguration common-info length octet and validate\nthe advertised common information length for all known MLE types. Keep\nunknown-type handling unchanged.\n\n[remove now misleading comment]",
  "id": "GHSA-q4hh-8fm2-f5vw",
  "modified": "2026-08-17T06:33:03Z",
  "published": "2026-08-15T06:32:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68471"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/293baeae9b2434a3e432629d7720b5603db2d77e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2b1589fd9a076727a73bfb39e96622a76415ad32"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/90576bd6921a91eb038bffbb4b9467c2dc26aa1d"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-68471 (GCVE-0-2026-68471)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:51 – Updated: 2026-08-17 05:39

Title

wifi: ieee80211: validate MLE common info length

Summary

In the Linux kernel, the following vulnerability has been resolved: wifi: ieee80211: validate MLE common info length ieee80211_mle_common_size() uses the first common-info octet as the common information length for all known MLE types. However, ieee80211_mle_size_ok() only validates that octet for Basic, Probe Request, and TDLS MLEs. Reconfiguration MLEs also skipped the length octet when calculating the minimum common size, and Priority Access MLEs skipped validation of the advertised common information length. Account for the Reconfiguration common-info length octet and validate the advertised common information length for all known MLE types. Keep unknown-type handling unchanged. [remove now misleading comment]

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root Scorecard

References

3 references

URL	Tags
https://git.kernel.org/stable/c/90576bd6921a91eb0…
https://git.kernel.org/stable/c/2b1589fd9a076727a…
https://git.kernel.org/stable/c/293baeae9b2434a3e…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada1 , < 90576bd6921a91eb038bffbb4b9467c2dc26aa1d (git) Affected: 0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada1 , < 2b1589fd9a076727a73bfb39e96622a76415ad32 (git) Affected: 0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada1 , < 293baeae9b2434a3e432629d7720b5603db2d77e (git)
Linux	Linux	Affected: 6.0 Unaffected: 0 , < 6.0 (semver) Unaffected: 6.18.40 , ≤ 6.18.* (semver) Unaffected: 7.1.5 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/ieee80211-eht.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "90576bd6921a91eb038bffbb4b9467c2dc26aa1d",
              "status": "affected",
              "version": "0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada1",
              "versionType": "git"
            },
            {
              "lessThan": "2b1589fd9a076727a73bfb39e96622a76415ad32",
              "status": "affected",
              "version": "0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada1",
              "versionType": "git"
            },
            {
              "lessThan": "293baeae9b2434a3e432629d7720b5603db2d77e",
              "status": "affected",
              "version": "0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/ieee80211-eht.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ieee80211: validate MLE common info length\n\nieee80211_mle_common_size() uses the first common-info octet as the\ncommon information length for all known MLE types. However,\nieee80211_mle_size_ok() only validates that octet for Basic, Probe\nRequest, and TDLS MLEs.\n\nReconfiguration MLEs also skipped the length octet when calculating the\nminimum common size, and Priority Access MLEs skipped validation of the\nadvertised common information length.\n\nAccount for the Reconfiguration common-info length octet and validate\nthe advertised common information length for all known MLE types. Keep\nunknown-type handling unchanged.\n\n[remove now misleading comment]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - Reachable by transmitting crafted 802.11 management frames (probe responses, beacons, protected EHT action frames) over WiFi; the mac80211/cfg80211 stack parses Multi-Link Elements on receive without requiring local access.\nAC:L - An adjacent attacker fully controls the MLE common-info length octet in forged frames and can reliably pass ieee80211_mle_size_ok() with an inflated value, triggering deterministic out-of-bounds parsing during routine scan or beacon processing.\nPR:N - No local privileges or association are required; a rogue AP or frame injector can deliver malicious MLEs to any scanning or MLD-associated station via standard pre-authentication WiFi management traffic.\nUI:N - Exploitation requires only passive reception of attacker-supplied WiFi frames during background scanning or normal beacon/action-frame handling; no victim interaction beyond having WiFi enabled.\nS:U - Impact is kernel heap out-of-bounds access within the WiFi stack on the victim host; it does not cross a VM, IOMMU, or sandbox security boundary to another authority.\nC:H - Inflated common_len makes ieee80211_mle_common_size() exceed the element buffer, causing for_each_element/cfg80211_defragment_element to read beyond the skb or kmalloc allocation, enabling unbounded kernel memory disclosure.\nI:H - The length underflow and out-of-bounds element iteration constitute exploitable kernel memory corruption; subsequent defragmentation and nested ie parsing can leverage corrupted pointers for arbitrary write primitives.\nA:H - Out-of-bounds reads of unmapped or non-element memory during MLE sub-element iteration can trigger a kernel oops or panic, remotely denying service to any WiFi-enabled device in range."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:39:14.035Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/90576bd6921a91eb038bffbb4b9467c2dc26aa1d"
        },
        {
          "url": "https://git.kernel.org/stable/c/2b1589fd9a076727a73bfb39e96622a76415ad32"
        },
        {
          "url": "https://git.kernel.org/stable/c/293baeae9b2434a3e432629d7720b5603db2d77e"
        }
      ],
      "title": "wifi: ieee80211: validate MLE common info length",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68471",
    "datePublished": "2026-08-15T05:51:29.001Z",
    "dateReserved": "2026-07-30T09:28:09.396Z",
    "dateUpdated": "2026-08-17T05:39:14.035Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-Q4HH-8FM2-F5VW

CVE-2026-68471 (GCVE-0-2026-68471)

Tags

Sightings

Nomenclature

Related by attack behaviour