CVE-2026-23152

What it actually does

Out-of-bounds read of one byte past the end of a TID-To-Link Mapping element during frame parsing in mac80211 when a default link map is in use.

Why it matters to the business

Local denial-of-service risk on Linux Wi-Fi systems that can crash the kernel or disrupt wireless connectivity; low external exploit likelihood reduces urgency but still requires patching on affected kernels.

How an attack unfolds

An attacker with local access crafts or supplies a Wi-Fi management frame containing a TTLM element that uses the default mapping; mac80211 incorrectly parses it without skipping and reads one byte beyond the element boundary, potentially triggering a kernel fault.

How to fix it

Update the Linux kernel to the fixed commit aabc36857bd39da65fe2d047bfaf63a0a09917d4 or later stable releases that contain it; rebuild and deploy the patched kernel across affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit aabc36857bd39da65fe2d047bfaf63a0a09917d4 or verify the fix by inspecting the mac80211 TTLM parsing code path for the added default-mapping skip logic.

Typical attack path

1. Obtain local user access on a Linux system running an affected kernel
2. Trigger or inject a crafted 802.11 frame with a default-mapped TTLM element
3. mac80211 performs incorrect parsing and reads past the element
4. Kernel memory fault leads to crash or availability impact

How to detect it

Review kernel logs for oops or panic entries referencing mac80211 TTLM parsing around the time of wireless frame processing; look for unexpected reboots or wireless interface resets on systems running vulnerable kernels.

What your security team should do

• Prioritize kernel updates on systems that use Wi-Fi (mac80211)
• Monitor EPSS trend and re-evaluate if score rises significantly
• Test patched kernels in staging before broad deployment