CVE-2026-68407

What it actually does

A memory leak occurs in nl80211_parse_beacon() when EMA RNR data is allocated for a beacon but rejected due to fewer RNR entries than MBSSID entries; the allocation is never attached and is not freed before returning the error.

Why it matters to the business

Repeated triggering on Linux systems handling wireless beacons can gradually exhaust kernel memory, leading to degraded wireless networking performance or denial of service for affected devices over time.

How an attack unfolds

An attacker supplies crafted beacon information via netlink that triggers the entry count mismatch in nl80211_parse_beacon, causing the kernel to leak the RNR allocation on each occurrence without recovery.

How to fix it

Apply the upstream Linux kernel patch that adds the missing free of rejected RNR data before returning the mismatch error in nl80211_parse_beacon.

How to confirm the fix worked

Inspect the nl80211.c source for the presence of the kfree on the RNR allocation in the MBSSID mismatch error path and confirm the change is present in the running kernel build.

Typical attack path

1. Obtain ability to send or configure beacon data through nl80211 netlink interface
2. Craft beacon with mismatched MBSSID and RNR entry counts to force rejection path
3. Repeat the operation to accumulate leaked kernel memory allocations
4. Observe gradual resource exhaustion affecting wireless stack stability

How to detect it

Review kernel memory allocation logs and slab statistics for repeated nl80211 RNR allocations without corresponding frees; correlate with netlink activity involving beacon parsing.

What your security team should do

• Prioritize kernel updates containing the nl80211 RNR free fix on all wireless-enabled Linux hosts
• Monitor kernel memory usage trends on systems exposing nl80211 interfaces
• Limit untrusted netlink access to wireless configuration where feasible