Executive brief
A vulnerability in the Linux kernel's Wi-Fi management component could allow a nearby attacker to cause a minor performance degradation. By broadcasting specially crafted Wi-Fi signals (beacons), an attacker can force the system to spend excessive time processing data, potentially leading to a localized denial-of-service or system sluggishness. This affects devices using the Linux kernel for wireless networking.
Technical details
A vulnerability exists in the cfg80211_merge_profile() function within the Linux kernel's wireless subsystem. The function fails to advance loop variables (mbssid_elem and sub_elem) when reassembling Multi-BSSID profiles split across multiple elements. This results in an infinite or highly redundant loop where the same data is repeatedly copied into a buffer until it fills. An attacker within radio range can broadcast a malicious beacon to trigger this behavior, causing the kernel to spend up to 2ms of processing time per received beacon. The issue has been patched across multiple stable kernel branches by ensuring loop variables are correctly updated.
Affected products
- Linux Linux Kernel fe806e4992c9 to 1343a480f84b, 1ced0f5a851f, 5817e1e52054, 67915715fd38, 6cfae4914439, 7666dbb1bacc, c0bc4c8bd556, cedbb608494ba
Timeline
- 2026-05-07: other: Vulnerability fix authored
- 2026-07-19: advisory: CVE published
References
- https://git.kernel.org/stable/c/1343a480f84b80c1249133a90ef87f8751d65cbb
- https://git.kernel.org/stable/c/1ced0f5a851f9cae274545a42a06c459b7fd8881
- https://git.kernel.org/stable/c/5817e1e5205498a5df66eba2b34e817f4210fd0f
- https://git.kernel.org/stable/c/67915715fd3874057457363c87c63e18829527df
- https://git.kernel.org/stable/c/6cfae4914439878b8acb35c7e3b40096eeb2ad9c
- https://git.kernel.org/stable/c/7666dbb1bacc4ba522b96740cba7283d243d16e1
- https://git.kernel.org/stable/c/c0bc4c8bd556cbe036a5b9ed333c0aab9aadfcb8