Executive brief
A security vulnerability exists in the Linux kernel's Wi-Fi management component. An attacker within Wi-Fi range could potentially crash the system or execute unauthorized code by sending a specially crafted wireless reconfiguration signal. This affects the stability and security of devices using impacted versions of the Linux operating system.
Technical details
A stack-based out-of-bounds write vulnerability exists in the mac80211 Wi-Fi stack within the Linux kernel. The issue resides in the 'ieee80211_ml_reconfiguration' function in 'net/mac80211/mlme.c', where a 'link_id' value is extracted from a Multi-Link (ML) Reconfiguration element without proper bounds checking. Because the 'link_id' can range from 0 to 15 while the 'link_removal_timeout' array only contains 15 elements, an attacker can trigger an out-of-bounds write at index 15. This can be exploited by an unauthenticated attacker on the adjacent wireless network to cause a denial of service or potentially achieve arbitrary code execution. Patches have been released across multiple stable kernel branches.
Affected products
- Linux Linux Kernel 6.5.1 to 6.6.130, 6.7 to 6.12.77, 6.13 to 6.18.17, 6.19 to 6.19.7, 7.0-rc1
Timeline
- 2026-03-18: disclosed
- 2026-03-18: advisory
- 2026-03-12: patched: Initial patches applied to stable branches.
References
- https://git.kernel.org/stable/c/162d331d833dc73a3e905a24c44dd33732af1fc5
- https://git.kernel.org/stable/c/650981e718e68005ca2760a6358134b8a98ebea4
- https://git.kernel.org/stable/c/bfde158d5d1322c0c2df398a8d1ccce04943be2e
- https://git.kernel.org/stable/c/d58d71c2167601762351962b9604808d3be94400
- https://git.kernel.org/stable/c/f35ceec54d48e227fa46f8f97fd100a77b8eab15