Executive brief
A vulnerability in the Linux kernel's Wi-Fi stack could allow a nearby attacker to cause a system crash or memory corruption. The issue occurs when the system processes specific types of fragmented Wi-Fi management frames (Multi-Link Elements). While the impact is primarily limited to service disruption, it affects the reliability of Wi-Fi connections on devices running newer versions of the Linux kernel.
Technical details
A vulnerability exists in the mac80211 stack of the Linux kernel during the defragmentation of Multi-Link Elements (MLE), specifically for reconfiguration or EPCS profiles. When these elements are contained in a non-transmitted profile, the defragmentation routine incorrectly uses pointers to original elements while operating on a defragmented copy. This logic error can lead to a heap buffer overflow if the original frame is located at a higher memory address than expected during parsing. An attacker within radio range could potentially exploit this by sending specially crafted Wi-Fi management frames. The issue has been resolved by tracking the container along with the pointer and unifying the defragmentation routines in net/mac80211/parse.c.
Affected products
- Linux Linux 6.9 to 6.12.91, 6.18.33, 7.0.10
Timeline
- 2026-07-25: disclosed
- 2026-07-25: advisory