Executive brief
A vulnerability in the Linux kernel's wireless networking component could cause a system crash when processing specific Wi-Fi configuration settings. This issue occurs when high-speed Wi-Fi features (HE/EHT) are partially configured, leading to an internal inconsistency. An attacker within Wi-Fi range could potentially exploit this to disrupt wireless services or cause a denial-of-service on the affected device.
Technical details
A vulnerability in the cfg80211 component of the Linux kernel's wireless stack allows for a kernel crash (denial of service) via the mac80211 module. The root cause is a lack of consistency enforcement between High Efficiency (HE) or Extremely High Throughput (EHT) capability and operation elements; specifically, a crash occurs if 'eht_cap' is set but 'eht_oper' is not. This can be triggered during Access Point (AP) parameter calculation in 'nl80211_calculate_ap_params'. The fix enforces that both capability and operation elements must be present or absent together. Patches have been released for various stable kernel branches including 6.16 and 7.0.13.
Affected products
- Linux Linux Kernel 6.16, 7.0.13, 7.1
Timeline
- 2026-06-03: patched: Initial fix commit by Johannes Berg
- 2026-06-25: disclosed: CVE published and NVD record created