Executive brief
The Linux kernel's WiFi mac80211 subsystem contains an out-of-bounds memory read vulnerability in the S1G Traffic Indication Map (TIM) parser. When a malicious or malformed WiFi frame is received with a TIM element at the end of the frame, an attacker can trigger the kernel to read sensitive adjacent memory data, potentially leading to information disclosure or denial of service.
Technical details
The vulnerability is a classic out-of-bounds read in the ieee80211_s1g_check_tim() function in net/mac80211/parse.c. The function parses the S1G Partial Virtual Bitmap (PVB) by walking through encoded blocks; however, it incorrectly passes an end-of-buffer sentinel that is 2 bytes past the actual TIM element boundary. The loop condition (ptr + 1 <= end) combined with pointer dereferences allows reading up to 2 bytes beyond the TIM element when it is the last element in a received frame. This can expose heap or stack data from adjacent socket buffer memory. The fix corrects the sentinel calculation by removing the erroneous +2 offset. The vulnerability affects kernels with the S1G TIM PVB support feature (introduced in commit e0c47c6229c2) and requires network reachability to a WiFi interface.
Affected products
- Linux Linux kernel all versions with S1G TIM PVB support (from commit e0c47c6229c2 onwards)
Timeline
- 2026-08-15: disclosed
- 2026-06-08: patched: Upstream patch merged in mac80211