CVE-2026-23246

HIGH EPSS 20.6%
Published Mar 18, 20263mo ago · Modified Jun 17, 20261w ago
8.8 CVSS 3.1
High
Find Similar
Published Mar 18, 2026 3mo ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration link_id is taken from the ML Reconfiguration element (control & 0x000f), so it can be 0..15. link_removal_timeout[] has IEEE80211_MLD_MAX_NUM_LINKS (15) elements, so index 15 is out-of-bounds. Skip subelements with link_id >= IEEE80211_MLD_MAX_NUM_LINKS to avoid a stack out-of-bounds write.

CVSS Details

Base Score
8.8
Exploitability
2.8
Impact
5.9
Vector string
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector Adjacent
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
20.6% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-129

Affected Products 6

VendorProductVersionRange
linuxlinux_kernel*≥6.5.1  –  <6.6.130
linuxlinux_kernel*≥6.7  –  <6.12.77
linuxlinux_kernel*≥6.13  –  <6.18.17
linuxlinux_kernel*≥6.19  –  <6.19.7
linuxlinux_kernel6.5any
linuxlinux_kernel7.0any

References 5

  • git.kernel.org https://git.kernel.org/stable/c/162d331d833dc73a3e905a24c44dd33732af1fc5
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/650981e718e68005ca2760a6358134b8a98ebea4
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/bfde158d5d1322c0c2df398a8d1ccce04943be2e
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/d58d71c2167601762351962b9604808d3be94400
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/f35ceec54d48e227fa46f8f97fd100a77b8eab15
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/162d331d833dc73a3e905a24c44dd33732af1fc5
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/650981e718e68005ca2760a6358134b8a98ebea4
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/bfde158d5d1322c0c2df398a8d1ccce04943be2e
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/d58d71c2167601762351962b9604808d3be94400
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/f35ceec54d48e227fa46f8f97fd100a77b8eab15
    Patch