Executive brief
A vulnerability in the Linux kernel's Wi-Fi framework could allow a nearby attacker to cause the system to read memory outside of its intended boundaries. This occurs when the system processes specific Wi-Fi management frames related to link mapping. While the technical impact is an out-of-bounds memory read, existing security checks prevent this from being used to change system policies or gain unauthorized control.
Technical details
An out-of-bounds (OOB) read exists in the ieee80211_parse_neg_ttlm() function within net/mac80211/mlme.c. The parser incorrectly advanced its data cursor for every Traffic Identifier (TID), even when the presence bit for a TID was clear, meaning no corresponding map bytes existed in the element. This logic error allows a specially crafted sparse map to cause subsequent reads to occur past the validated element buffer. Although the OOB data is captured, it is gated by valid_links checks before affecting driver state, limiting the impact primarily to potential information disclosure or memory corruption detectable by KASAN. The issue has been patched by ensuring the cursor only advances when a map is actually present.
Affected products
- Linux Linux 6.9 to 6.12.92, 6.18.34, 7.0.11
Timeline
- 2026-05-15: other: Patch submitted by Michael Bommarito
- 2026-07-24: advisory: CVE-2026-64223 published