CVE-2026-97518

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97518", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-24T16:01:01.152Z", "datePublished": "2026-09-24T16:05:18.072Z", "dateUpdated": "2026-10-30T12:37:09.335Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:37:09.335Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: reject duplicate wiphy cipher suite entries\n\nDuplicate entries in wiphy->cipher_suites do not describe any\nadditional capability, but cfg80211 currently accepts them and leaves\nindividual consumers to deal with them.\n\nOne such consumer is the WEXT compatibility code, which appends a WEP\nkey length for each WEP cipher entry it sees. Repeated WEP entries can\ntherefore overflow the fixed iw_range::encoding_size array returned by\nSIOCGIWRANGE.\n\nReject duplicate cipher suite entries in wiphy_register() instead.\nThis keeps the cipher suite invariant in one place and makes malformed\nwiphy descriptions fail early with -EINVAL, rather than relying on a\nsingle cfg80211 user to handle duplicates correctly."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/wireless/core.c"], "versions": [{"version": "2ab658f9ce218ae93b3d2db2b3fe68bfefb81196", "lessThan": "539d7f795bf0c41fb533c99e6010cdfaf5a1b6a6", "status": "affected", "versionType": "git"}, {"version": "2ab658f9ce218ae93b3d2db2b3fe68bfefb81196", "lessThan": "d12e92e72db914e1ea777c6f246f6be75985438e", "status": "affected", "versionType": "git"}, {"version": "2ab658f9ce218ae93b3d2db2b3fe68bfefb81196", "lessThan": "1305f8b925fe92edf5fec183588dfc7db719180b", "status": "affected", "versionType": "git"}, {"version": "2ab658f9ce218ae93b3d2db2b3fe68bfefb81196", "lessThan": "4cbb2360f4d8c29e67bc7a8bf6ba0ae096583923", "status": "affected", "versionType": "git"}, {"version": "2ab658f9ce218ae93b3d2db2b3fe68bfefb81196", "lessThan": "7187d145d9042b037e4f10538f70cf95e380219f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/wireless/core.c"], "versions": [{"version": "2.6.32", "status": "affected"}, {"version": "0", "lessThan": "2.6.32", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.32", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.32", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.32", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.32", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.32", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/539d7f795bf0c41fb533c99e6010cdfaf5a1b6a6"}, {"url": "https://git.kernel.org/stable/c/d12e92e72db914e1ea777c6f246f6be75985438e"}, {"url": "https://git.kernel.org/stable/c/1305f8b925fe92edf5fec183588dfc7db719180b"}, {"url": "https://git.kernel.org/stable/c/4cbb2360f4d8c29e67bc7a8bf6ba0ae096583923"}, {"url": "https://git.kernel.org/stable/c/7187d145d9042b037e4f10538f70cf95e380219f"}], "title": "wifi: cfg80211: reject duplicate wiphy cipher suite entries", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/wireless/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "539d7f795bf0c41fb533c99e6010cdfaf5a1b6a6", "status": "affected", "version": "2ab658f9ce218ae93b3d2db2b3fe68bfefb81196", "versionType": "git"}, {"lessThan": "d12e92e72db914e1ea777c6f246f6be75985438e", "status": "affected", "version": "2ab658f9ce218ae93b3d2db2b3fe68bfefb81196", "versionType": "git"}, {"lessThan": "1305f8b925fe92edf5fec183588dfc7db719180b", "status": "affected", "version": "2ab658f9ce218ae93b3d2db2b3fe68bfefb81196", "versionType": "git"}, {"lessThan": "4cbb2360f4d8c29e67bc7a8bf6ba0ae096583923", "status": "affected", "version": "2ab658f9ce218ae93b3d2db2b3fe68bfefb81196", "versionType": "git"}, {"lessThan": "7187d145d9042b037e4f10538f70cf95e380219f", "status": "affected", "version": "2ab658f9ce218ae93b3d2db2b3fe68bfefb81196", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/wireless/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.32"}, {"lessThan": "2.6.32", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: reject duplicate wiphy cipher suite entries\n\nDuplicate entries in wiphy->cipher_suites do not describe any\nadditional capability, but cfg80211 currently accepts them and leaves\nindividual consumers to deal with them.\n\nOne such consumer is the WEXT compatibility code, which appends a WEP\nkey length for each WEP cipher entry it sees. Repeated WEP entries can\ntherefore overflow the fixed iw_range::encoding_size array returned by\nSIOCGIWRANGE.\n\nReject duplicate cipher suite entries in wiphy_register() instead.\nThis keeps the cipher suite invariant in one place and makes malformed\nwiphy descriptions fail early with -EINVAL, rather than relying on a\nsingle cfg80211 user to handle duplicates correctly."}], "id": "CVE-2026-97518", "lastModified": "2026-10-30T13:21:06.160", "metrics": {}, "published": "2026-09-24T17:17:29.787", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1305f8b925fe92edf5fec183588dfc7db719180b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4cbb2360f4d8c29e67bc7a8bf6ba0ae096583923"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/539d7f795bf0c41fb533c99e6010cdfaf5a1b6a6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7187d145d9042b037e4f10538f70cf95e380219f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d12e92e72db914e1ea777c6f246f6be75985438e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: wifi: cfg80211: reject duplicate wiphy cipher suite entries", "id": "2540382", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540382"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nwifi: cfg80211: reject duplicate wiphy cipher suite entries\nDuplicate entries in wiphy->cipher_suites do not describe any\nadditional capability, but cfg80211 currently accepts them and leaves\nindividual consumers to deal with them.\nOne such consumer is the WEXT compatibility code, which appends a WEP\nkey length for each WEP cipher entry it sees. Repeated WEP entries can\ntherefore overflow the fixed iw_range::encoding_size array returned by\nSIOCGIWRANGE.\nReject duplicate cipher suite entries in wiphy_register() instead.\nThis keeps the cipher suite invariant in one place and makes malformed\nwiphy descriptions fail early with -EINVAL, rather than relying on a\nsingle cfg80211 user to handle duplicates correctly.", "A flaw was found in the Linux kernel's cfg80211 wireless configuration subsystem. The subsystem fails to reject duplicate cipher suite entries during wireless device registration. This flaw allows a local user to cause an array buffer overflow within the Wireless Extensions (WEXT) compatibility layer, leading to memory corruption and a Denial of Service (DoS) via a system crash."], "name": "CVE-2026-97518", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97518\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97518\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97518.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,1305f8b925fe92edf5fec183588dfc7db719180b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,4cbb2360f4d8c29e67bc7a8bf6ba0ae096583923)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,7187d145d9042b037e4f10538f70cf95e380219f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.12.111)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.18.53)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T01:00:11.903582+00:00", "updated": "2026-10-01T10:30:08.277715+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-119", "CWE-787"]}