Cloudanix VulnDB

CVE-2026-68402

High · 7.1

CVSS

7.1

EPSS

0.3%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A bug in how Linux handles certain Wi-Fi management messages from access points can cause the system to read memory it should not, potentially crashing the machine or leaking small amounts of data.

Exploitation
Adjacent Network
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds read of one octet when cfg80211_is_element_inherited() processes a zero-length WLAN_EID_EXTENSION element during ieee802_11_parse_elems_full() parsing of 802.11 frames containing Multi-Link or non-transmitted BSS profiles.

Why it matters to the business

Wireless Linux systems may experience kernel crashes or limited memory disclosure when associating with a malicious access point, leading to denial of service on Wi-Fi clients and potential stability issues in dense wireless environments.

How an attack unfolds

An attacker operating a rogue AP crafts a (re)association response containing a Multi-Link element with a zero-length extension element. When the victim parses the per-STA profile, cfg80211_is_element_inherited() reads past the element buffer, triggering a KASAN-detected slab-out-of-bounds read.

How to fix it

Apply the upstream fix that returns early for zero-length extension elements. Rebuild and deploy updated Linux kernels containing the corrected cfg80211 code; prioritize systems with active Wi-Fi interfaces.

How to confirm the fix worked

Confirm the kernel contains the patch by inspecting net/wireless/scan.c for the early-return check on extension elements with length 0, or verify the KASAN bug no longer reproduces under fuzzing of ieee802_11_parse_elems_full().

Typical attack path

  1. Attacker brings up a malicious 802.11 AP that sends crafted association responses
  2. Victim client receives and parses the frame inside _ieee802_11_parse_elems_full()
  3. Non-inheritance context triggers cfg80211_is_element_inherited() on a length-0 extension element
  4. Kernel performs one-byte read beyond the element, causing slab OOB access

How to detect it

Search kernel logs for KASAN reports containing cfg80211_is_element_inherited and slab-out-of-bounds reads during wireless frame parsing; correlate with association events from untrusted BSSIDs.

  • BUG: KASAN: slab-out-of-bounds in cfg80211_is_element_inherited
  • Read of size 1 ... in net/wireless/scan.c

What your security team should do

  • Patch Linux kernels on all Wi-Fi client systems within normal change windows given low EPSS and no KEV listing
  • Monitor for kernel oops or KASAN reports referencing cfg80211_is_element_inherited or scan.c
  • Consider disabling unnecessary 802.11 features such as Multi-Link Operation if patching is delayed

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: bound element ID read when checking non-inheritance cfg80211_is_element_inherited() reads the first data octet of the candidate element (id = elem->data[0]) to look it up in an extension non-inheritance list. It does so after testing elem->id, but without verifying that the element actually has a data octet. A zero-length extension element (WLAN_EID_EXTENSION with length 0) therefore makes it read one octet past the end of the element. _ieee802_11_parse_elems_full() runs this check for every element of a frame once a non-inheritance context exists -- e.g. while parsing a per-STA profile of a Multi-Link element in a (re)association response, or a non-transmitted BSS profile -- so a crafted frame from an AP can trigger a one-octet slab-out-of-bounds read during element parsing: BUG: KASAN: slab-out-of-bounds in cfg80211_is_element_inherited Read of size 1 ... in net/wireless/scan.c Return early (treat the element as inherited) when an extension element carries no data, mirroring the existing handling of empty ID lists. The bug was found by fuzzing ieee802_11_parse_elems_full() under KASAN.

Affected packages

Ecosystem Package Introduced Fixed