CVE-2020-26147

What it actually does

The Linux kernel Wi-Fi stack reassembles 802.11 fragments even when some arrive unencrypted under WEP, CCMP or GCMP, allowing an adjacent attacker to inject chosen plaintext fragments or recover selected ciphertext fragments from a victim's traffic.

Why it matters to the business

Attackers on the same wireless network can inject packets or steal pieces of sensitive data without needing credentials, increasing exposure for any organization using affected Linux-based wireless devices until patches are applied.

How an attack unfolds

An attacker on the same Wi-Fi network sends carefully crafted fragmented frames mixed with plaintext fragments; the kernel reassembles them anyway, enabling packet injection or selective exfiltration when the victim transmits fragmented frames protected by WEP/CCMP/GCMP.

How to fix it

Upgrade affected chromium packages to the listed fixed versions: chromium (Debian:11/12/13) to 87.0.4280.88-0.1 and chromium-browser (Ubuntu 16.04 LTS) to 87.0.4280.66-0ubuntu0.16.04.1. Apply kernel updates that enforce plaintext fragment rejection for all supported distributions.

How to confirm the fix worked

Confirm the installed chromium or kernel package version matches or exceeds the fixed releases above, then verify that fragmented frames containing plaintext are dropped by monitoring 802.11 reassembly behavior with wireless packet captures.

Typical attack path

1. Position on same wireless network as target
2. Observe or trigger fragmented 802.11 frames from victim
3. Inject chosen plaintext fragments that the kernel will reassemble
4. Exfiltrate or modify selected data fragments from the reassembled frame

How to detect it

Review wireless packet captures and kernel logs for unexpected reassembly of mixed plaintext/encrypted fragments; correlate with 802.11 frame timestamps showing injection patterns on affected devices.

What your security team should do

• Prioritize patching chromium and kernel packages on all Linux wireless endpoints within standard change windows
• Disable WEP and prefer WPA3 with protected management frames where hardware supports it
• Monitor EPSS and threat landscape reports for any future rise in exploit maturity