Executive brief
A vulnerability was identified in the Linux kernel's wireless networking component (nl80211) that could allow for memory-related issues when processing specific Wi-Fi data lists. The system failed to properly limit the number of elements in certain Wi-Fi reporting lists, which could potentially lead to system instability or crashes. This issue has been resolved by implementing a strict limit on the number of elements allowed in these lists.
Technical details
A vulnerability in nl80211_parse_rnr_elems() in the Linux kernel's wireless subsystem allowed for an unbounded number of elements in EMA RNR lists. The function stored the element count in a u8-backed field (max 255) but did not enforce this limit before incrementing the counter and using it to size flexible array allocations. This mismatch between the counter type and the input size could lead to memory corruption or incorrect allocation sizes. The fix introduces a check to reject input once the count reaches 255, aligning the parser with the underlying data structure. This issue affects kernels from version 6.4 up to 7.1.
Affected products
- Linux Linux Kernel 6.4 to 7.1
Timeline
- 2026-05-29: disclosed: Initial patch submitted by Yuqi Xu
- 2026-06-02: patched: Patch committed to main branch
- 2026-06-25: advisory: CVE-2026-53182 published
References
- https://git.kernel.org/stable/c/265c07c09c837621730d35f02975207a1224bf05
- https://git.kernel.org/stable/c/30c3fa80f423613efdda3deca4af52ff7d20e4e2
- https://git.kernel.org/stable/c/4cd92957e8f8cc4ebfe8a5d4203c14c592fde6b1
- https://git.kernel.org/stable/c/688fcac7054abc680c0eef753f2bb772cfaf8cf7
- https://git.kernel.org/stable/c/ecbf3c45add30a0857414e156bdb9c79906f0ff6
- https://git.kernel.org/stable/c/fc0ec2fc02dfe52c5821f36fbccf6a45df43f508