Cloudanix VulnDB

CVE-2026-68412

None

CVSS

—

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A small coding mistake in Linux wireless networking can slowly drain system memory when certain invalid requests are received, eventually making the computer unstable.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

A memory leak occurs in cfg80211_wext_siwscan when the IEEE80211_MAX_SSID_LEN check fails because the allocated creq structure is not released on the error path.

Why it matters to the business

Repeated triggering can gradually exhaust kernel memory on Linux systems using wireless extensions, leading to performance degradation or denial of service over extended periods.

How an attack unfolds

An attacker supplies an oversized SSID via the wireless extensions interface to force the length check failure, causing the allocation to leak; repeated invocations accumulate unreleased memory until the system becomes unstable.

How to fix it

Apply the upstream kernel patch that routes the length-check failure through the existing error-handling path to release creq; update to a fixed kernel release containing this change.

How to confirm the fix worked

Review the cfg80211_wext_siwscan function in the patched kernel source to confirm creq is freed on the length-error path; monitor memory usage under repeated invalid scan attempts to verify the leak is closed.

Typical attack path

  1. Locate a target running a vulnerable kernel with wireless extensions enabled
  2. Issue crafted SIWSCAN requests containing SSIDs longer than IEEE80211_MAX_SSID_LEN
  3. Repeat the requests at sufficient volume to produce measurable memory exhaustion

How to detect it

Examine kernel logs for wireless extension error paths, correlate with memory usage counters from /proc/meminfo or slabinfo, and look for repeated oversized SSID scan attempts in audit or netlink traces.

What your security team should do

  • Apply kernel updates containing the error-path fix to all systems exposing wireless extensions
  • Disable wireless extensions (CONFIG_CFG80211_WEXT) where wireless scanning via ioctl is unnecessary
  • Track kernel memory consumption metrics and correlate spikes with wireless activity

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan() If the test against IEEE80211_MAX_SSID_LEN fails, then 'creq' leaks. Use the existing error handling path to fix it.

Affected packages

Ecosystem Package Introduced Fixed