CVE-2026-68472

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68472", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.396Z", "datePublished": "2026-08-15T05:51:29.634Z", "dateUpdated": "2026-10-19T21:09:11.873Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:39:15.119Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: validate EHT MLE before MLD ID read\n\ncfg80211_gen_new_ie() copies ML probe response elements from\nthe parent frame when the parent EHT multi-link element has an\nMLD ID matching the nontransmitted BSSID index.\n\nThe code only checked that the extension element had more than\none byte before calling ieee80211_mle_get_mld_id(). That helper\nassumes a BASIC MLE with enough common info and documents that\ncallers must first use ieee80211_mle_type_ok().\n\nAttack chain:\nmalicious AP sends a short EHT MLE in an MBSSID beacon.\ncfg80211_inform_bss_frame_data() stores the copied IE buffer.\ncfg80211_parse_mbssid_data() builds the nontransmitted BSS IE.\ncfg80211_gen_new_ie() sees the EHT MLE in the parent frame.\nieee80211_mle_get_mld_id() then reads past the IE boundary.\n\nValidate the MLE type and size before reading the MLD ID. This\nmatches the contract required by the MLE helper and rejects the\nshort element before any internal MLE fields are accessed."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "baseScore": 8.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - A malicious AP within Wi-Fi radio range can send a crafted MBSSID beacon with a truncated EHT Multi-Link element; cfg80211_inform_bss_frame_data() processes it on scanning or associated STAs without routable network access.\nAC:L - The attacker fully controls beacon IE layout, MLE control/presence bits, and the nontransmitted BSSID index, deterministically triggering ieee80211_mle_get_mld_id() past the element boundary without races or memory-layout luck.\nPR:N - Beacon and MBSSID parsing run before authentication or association on the automatic RX path; no victim credentials, local account, or kernel capability is required to deliver the malformed frame.\nUI:N - Stations automatically receive and process beacons during periodic background, scheduled, and connected-mode scanning without any user action beyond normal Wi-Fi operation.\nS:U - The out-of-bounds read and any resulting fault occur entirely within the host kernel security authority; no VM, IOMMU, container, or sandbox boundary is crossed.\nC:H - ieee80211_mle_get_mld_id() walks attacker-controlled optional MLE fields and reads past the truncated element into adjacent skb or kernel memory beyond the declared IE length, enabling kernel memory disclosure.\nI:N - The defect is an out-of-bounds read used only to compare an MLD ID before optional element copying; it does not perform out-of-bounds writes or provide a control-flow or arbitrary-write primitive.\nA:H - Reads past the receive buffer can fault under KASAN/KFENCE or hit unmapped memory, and a rogue AP can retransmit crafted beacons indefinitely to repeatedly trigger kernel oops or panic."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/wireless/scan.c"], "versions": [{"version": "61dcfa8c2a8f6c53ce77b2c832b82990754b2aa9", "lessThan": "584657c5fc58d7a840623a2fa06331c9661dd0f1", "status": "affected", "versionType": "git"}, {"version": "61dcfa8c2a8f6c53ce77b2c832b82990754b2aa9", "lessThan": "3b0505e43da8fb5b2a7994c3c3604e5a74692154", "status": "affected", "versionType": "git"}, {"version": "61dcfa8c2a8f6c53ce77b2c832b82990754b2aa9", "lessThan": "74e27cd1d98b546fdb276008a83708d062339661", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/wireless/scan.c"], "versions": [{"version": "6.14", "status": "affected"}, {"version": "0", "lessThan": "6.14", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.14", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/584657c5fc58d7a840623a2fa06331c9661dd0f1"}, {"url": "https://git.kernel.org/stable/c/3b0505e43da8fb5b2a7994c3c3604e5a74692154"}, {"url": "https://git.kernel.org/stable/c/74e27cd1d98b546fdb276008a83708d062339661"}], "title": "wifi: cfg80211: validate EHT MLE before MLD ID read", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-68472", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:49:34.576724Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T21:09:11.873Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-68472", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:49:34.576724Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:49:35.723Z"}}], "cna": {"title": "wifi: cfg80211: validate EHT MLE before MLD ID read", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:A - A malicious AP within Wi-Fi radio range can send a crafted MBSSID beacon with a truncated EHT Multi-Link element; cfg80211_inform_bss_frame_data() processes it on scanning or associated STAs without routable network access.\nAC:L - The attacker fully controls beacon IE layout, MLE control/presence bits, and the nontransmitted BSSID index, deterministically triggering ieee80211_mle_get_mld_id() past the element boundary without races or memory-layout luck.\nPR:N - Beacon and MBSSID parsing run before authentication or association on the automatic RX path; no victim credentials, local account, or kernel capability is required to deliver the malformed frame.\nUI:N - Stations automatically receive and process beacons during periodic background, scheduled, and connected-mode scanning without any user action beyond normal Wi-Fi operation.\nS:U - The out-of-bounds read and any resulting fault occur entirely within the host kernel security authority; no VM, IOMMU, container, or sandbox boundary is crossed.\nC:H - ieee80211_mle_get_mld_id() walks attacker-controlled optional MLE fields and reads past the truncated element into adjacent skb or kernel memory beyond the declared IE length, enabling kernel memory disclosure.\nI:N - The defect is an out-of-bounds read used only to compare an MLD ID before optional element copying; it does not perform out-of-bounds writes or provide a control-flow or arbitrary-write primitive.\nA:H - Reads past the receive buffer can fault under KASAN/KFENCE or hit unmapped memory, and a rogue AP can retransmit crafted beacons indefinitely to repeatedly trigger kernel oops or panic."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "61dcfa8c2a8f6c53ce77b2c832b82990754b2aa9", "lessThan": "584657c5fc58d7a840623a2fa06331c9661dd0f1", "versionType": "git"}, {"status": "affected", "version": "61dcfa8c2a8f6c53ce77b2c832b82990754b2aa9", "lessThan": "3b0505e43da8fb5b2a7994c3c3604e5a74692154", "versionType": "git"}, {"status": "affected", "version": "61dcfa8c2a8f6c53ce77b2c832b82990754b2aa9", "lessThan": "74e27cd1d98b546fdb276008a83708d062339661", "versionType": "git"}], "programFiles": ["net/wireless/scan.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.14"}, {"status": "unaffected", "version": "0", "lessThan": "6.14", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.40", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.5", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/wireless/scan.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/584657c5fc58d7a840623a2fa06331c9661dd0f1"}, {"url": "https://git.kernel.org/stable/c/3b0505e43da8fb5b2a7994c3c3604e5a74692154"}, {"url": "https://git.kernel.org/stable/c/74e27cd1d98b546fdb276008a83708d062339661"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: validate EHT MLE before MLD ID read\n\ncfg80211_gen_new_ie() copies ML probe response elements from\nthe parent frame when the parent EHT multi-link element has an\nMLD ID matching the nontransmitted BSSID index.\n\nThe code only checked that the extension element had more than\none byte before calling ieee80211_mle_get_mld_id(). That helper\nassumes a BASIC MLE with enough common info and documents that\ncallers must first use ieee80211_mle_type_ok().\n\nAttack chain:\nmalicious AP sends a short EHT MLE in an MBSSID beacon.\ncfg80211_inform_bss_frame_data() stores the copied IE buffer.\ncfg80211_parse_mbssid_data() builds the nontransmitted BSS IE.\ncfg80211_gen_new_ie() sees the EHT MLE in the parent frame.\nieee80211_mle_get_mld_id() then reads past the IE boundary.\n\nValidate the MLE type and size before reading the MLD ID. This\nmatches the contract required by the MLE helper and rejects the\nshort element before any internal MLE fields are accessed."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.40", "versionStartIncluding": "6.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.5", "versionStartIncluding": "6.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "6.14"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:39:15.119Z"}}}, "cveMetadata": {"cveId": "CVE-2026-68472", "state": "PUBLISHED", "dateUpdated": "2026-10-19T21:09:11.873Z", "dateReserved": "2026-07-30T09:28:09.396Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-15T05:51:29.634Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/wireless/scan.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "584657c5fc58d7a840623a2fa06331c9661dd0f1", "status": "affected", "version": "61dcfa8c2a8f6c53ce77b2c832b82990754b2aa9", "versionType": "git"}, {"lessThan": "3b0505e43da8fb5b2a7994c3c3604e5a74692154", "status": "affected", "version": "61dcfa8c2a8f6c53ce77b2c832b82990754b2aa9", "versionType": "git"}, {"lessThan": "74e27cd1d98b546fdb276008a83708d062339661", "status": "affected", "version": "61dcfa8c2a8f6c53ce77b2c832b82990754b2aa9", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/wireless/scan.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.14"}, {"lessThan": "6.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: validate EHT MLE before MLD ID read\n\ncfg80211_gen_new_ie() copies ML probe response elements from\nthe parent frame when the parent EHT multi-link element has an\nMLD ID matching the nontransmitted BSSID index.\n\nThe code only checked that the extension element had more than\none byte before calling ieee80211_mle_get_mld_id(). That helper\nassumes a BASIC MLE with enough common info and documents that\ncallers must first use ieee80211_mle_type_ok().\n\nAttack chain:\nmalicious AP sends a short EHT MLE in an MBSSID beacon.\ncfg80211_inform_bss_frame_data() stores the copied IE buffer.\ncfg80211_parse_mbssid_data() builds the nontransmitted BSS IE.\ncfg80211_gen_new_ie() sees the EHT MLE in the parent frame.\nieee80211_mle_get_mld_id() then reads past the IE boundary.\n\nValidate the MLE type and size before reading the MLD ID. This\nmatches the contract required by the MLE helper and rejects the\nshort element before any internal MLE fields are accessed."}], "id": "CVE-2026-68472", "lastModified": "2026-10-19T22:17:20.770", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-68472", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:49:34.576724Z", "version": "2.0.3"}}]}, "published": "2026-08-15T06:20:05.570", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3b0505e43da8fb5b2a7994c3c3604e5a74692154"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/584657c5fc58d7a840623a2fa06331c9661dd0f1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/74e27cd1d98b546fdb276008a83708d062339661"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: wifi: cfg80211: validate EHT MLE before MLD ID read", "id": "2516359", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516359"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in the Linux kernel's cfg80211 Wi-Fi subsystem. A remote attacker, by operating a malicious Access Point (AP), could send a specially crafted EHT Multi-Link Element (MLE) in an MBSSID beacon. This could cause the kernel to read beyond the intended memory boundary when processing the MLE, potentially leading to information disclosure or a denial of service (DoS)."], "name": "CVE-2026-68472", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68472\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68472\nhttps://lore.kernel.org/linux-cve-announce/2026081505-CVE-2026-68472-2865@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[61dcfa8c2a8f6c53ce77b2c832b82990754b2aa9,584657c5fc58d7a840623a2fa06331c9661dd0f1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[61dcfa8c2a8f6c53ce77b2c832b82990754b2aa9,3b0505e43da8fb5b2a7994c3c3604e5a74692154)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[61dcfa8c2a8f6c53ce77b2c832b82990754b2aa9,74e27cd1d98b546fdb276008a83708d062339661)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.14"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.14)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.40,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc4,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T09:30:04.651061+00:00", "updated": "2026-08-18T04:15:04.831922+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}