CVE-2026-68407

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68407", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.390Z", "datePublished": "2026-08-10T12:04:27.252Z", "dateUpdated": "2026-08-19T16:35:02.178Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:35:02.178Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: nl80211: free RNR data on MBSSID mismatch\n\nnl80211_parse_beacon() rejects EMA RNR data when there are fewer RNR\nentries than MBSSID entries.\n\nThe rejected RNR allocation has not been attached to the beacon data yet,\nso free it before returning the error."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/wireless/nl80211.c"], "versions": [{"version": "56189d7bc30531def6b999f27940ee43c6ff2569", "lessThan": "4b76fc30c80b240107a7de3c7560113c9290eafc", "status": "affected", "versionType": "git"}, {"version": "dbbb27e183b1568d5a907ace1cd144b0709ea52a", "lessThan": "fa9592ef7de11f8c7042315d9bc20e91a97f679e", "status": "affected", "versionType": "git"}, {"version": "dbbb27e183b1568d5a907ace1cd144b0709ea52a", "lessThan": "312c8b9d7836ef58e552619a8c19be08b04032bb", "status": "affected", "versionType": "git"}, {"version": "dbbb27e183b1568d5a907ace1cd144b0709ea52a", "lessThan": "fb052a6e2fa866384d8edc237746583ec94c15af", "status": "affected", "versionType": "git"}, {"version": "dbbb27e183b1568d5a907ace1cd144b0709ea52a", "lessThan": "6f919f29e9b75793104709987131b8d910d7800a", "status": "affected", "versionType": "git"}, {"version": "dbbb27e183b1568d5a907ace1cd144b0709ea52a", "lessThan": "07a95ec2b54774201fdf4ef7ffb0ca2ab19ed29c", "status": "affected", "versionType": "git"}, {"version": "6.1.160", "lessThan": "6.1.183", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/wireless/nl80211.c"], "versions": [{"version": "6.4", "status": "affected"}, {"version": "0", "lessThan": "6.4", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.148", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.101", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.160", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.6.148"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.12.101"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.18.42"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "7.1.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/4b76fc30c80b240107a7de3c7560113c9290eafc"}, {"url": "https://git.kernel.org/stable/c/fa9592ef7de11f8c7042315d9bc20e91a97f679e"}, {"url": "https://git.kernel.org/stable/c/312c8b9d7836ef58e552619a8c19be08b04032bb"}, {"url": "https://git.kernel.org/stable/c/fb052a6e2fa866384d8edc237746583ec94c15af"}, {"url": "https://git.kernel.org/stable/c/6f919f29e9b75793104709987131b8d910d7800a"}, {"url": "https://git.kernel.org/stable/c/07a95ec2b54774201fdf4ef7ffb0ca2ab19ed29c"}], "title": "wifi: nl80211: free RNR data on MBSSID mismatch", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/wireless/nl80211.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "4b76fc30c80b240107a7de3c7560113c9290eafc", "status": "affected", "version": "56189d7bc30531def6b999f27940ee43c6ff2569", "versionType": "git"}, {"lessThan": "fa9592ef7de11f8c7042315d9bc20e91a97f679e", "status": "affected", "version": "dbbb27e183b1568d5a907ace1cd144b0709ea52a", "versionType": "git"}, {"lessThan": "312c8b9d7836ef58e552619a8c19be08b04032bb", "status": "affected", "version": "dbbb27e183b1568d5a907ace1cd144b0709ea52a", "versionType": "git"}, {"lessThan": "fb052a6e2fa866384d8edc237746583ec94c15af", "status": "affected", "version": "dbbb27e183b1568d5a907ace1cd144b0709ea52a", "versionType": "git"}, {"lessThan": "6f919f29e9b75793104709987131b8d910d7800a", "status": "affected", "version": "dbbb27e183b1568d5a907ace1cd144b0709ea52a", "versionType": "git"}, {"lessThan": "07a95ec2b54774201fdf4ef7ffb0ca2ab19ed29c", "status": "affected", "version": "dbbb27e183b1568d5a907ace1cd144b0709ea52a", "versionType": "git"}, {"lessThan": "6.1.183", "status": "affected", "version": "6.1.160", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/wireless/nl80211.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.4"}, {"lessThan": "6.4", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.148", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.101", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.42", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: nl80211: free RNR data on MBSSID mismatch\n\nnl80211_parse_beacon() rejects EMA RNR data when there are fewer RNR\nentries than MBSSID entries.\n\nThe rejected RNR allocation has not been attached to the beacon data yet,\nso free it before returning the error."}], "id": "CVE-2026-68407", "lastModified": "2026-08-19T17:20:48.570", "metrics": {}, "published": "2026-08-10T13:20:34.290", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/07a95ec2b54774201fdf4ef7ffb0ca2ab19ed29c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/312c8b9d7836ef58e552619a8c19be08b04032bb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4b76fc30c80b240107a7de3c7560113c9290eafc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6f919f29e9b75793104709987131b8d910d7800a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fa9592ef7de11f8c7042315d9bc20e91a97f679e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fb052a6e2fa866384d8edc237746583ec94c15af"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel: Wi-Fi subsystem memory leak via nl80211 beacon parsing", "id": "2513220", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513220"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nwifi: nl80211: free RNR data on MBSSID mismatch\nnl80211_parse_beacon() rejects EMA RNR data when there are fewer RNR\nentries than MBSSID entries.\nThe rejected RNR allocation has not been attached to the beacon data yet,\nso free it before returning the error.", "A flaw was found in the Linux kernel's Wi-Fi subsystem (nl80211). When processing beacon frames, the `nl80211_parse_beacon()` function may fail to properly free allocated RNR (Reduced Neighbor Report) data if there is a mismatch in the number of RNR and MBSSID (Multiple Basic Service Set Identifier) entries. This improper memory handling could lead to a memory leak, potentially allowing a remote attacker to cause a denial of service."], "name": "CVE-2026-68407", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_nvidia:", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux for NVIDIA 26"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-08-10T12:04:27Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68407\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68407\nhttps://git.kernel.org/stable/c/07a95ec2b54774201fdf4ef7ffb0ca2ab19ed29c\nhttps://git.kernel.org/stable/c/312c8b9d7836ef58e552619a8c19be08b04032bb\nhttps://git.kernel.org/stable/c/6f919f29e9b75793104709987131b8d910d7800a\nhttps://git.kernel.org/stable/c/fa9592ef7de11f8c7042315d9bc20e91a97f679e\nhttps://git.kernel.org/stable/c/fb052a6e2fa866384d8edc237746583ec94c15af"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[dbbb27e183b1568d5a907ace1cd144b0709ea52a,fa9592ef7de11f8c7042315d9bc20e91a97f679e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[dbbb27e183b1568d5a907ace1cd144b0709ea52a,312c8b9d7836ef58e552619a8c19be08b04032bb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[dbbb27e183b1568d5a907ace1cd144b0709ea52a,fb052a6e2fa866384d8edc237746583ec94c15af)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[dbbb27e183b1568d5a907ace1cd144b0709ea52a,6f919f29e9b75793104709987131b8d910d7800a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[dbbb27e183b1568d5a907ace1cd144b0709ea52a,07a95ec2b54774201fdf4ef7ffb0ca2ab19ed29c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "56189d7bc30531def6b999f27940ee43c6ff2569"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.1.160,6.2)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.4"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.4)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.148,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.101,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.42,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.6,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc4,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-10T16:15:04.433762+00:00", "updated": "2026-08-12T19:15:04.128012+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-590", "CWE-772"]}