wifi: mac80211: consume only present negotiated TTLM maps
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: consume only present negotiated TTLM maps ieee80211_tid_to_link_map_size_ok() validates negotiated TTLM elements against the number of link-map entries indicated by link_map_presence. ieee80211_parse_neg_ttlm() must consume the same layout. The parser advanced its cursor for every TID, including TIDs whose presence bit is clear and therefore have no map bytes in the element. A sparse map can then make a later present TID read past the validated element. The bad bytes land in neg_ttlm->{up,down}link[tid] but are gated by valid_links before being applied to driver state, so a peer cannot turn the read into a policy change. Under KUnit + KASAN with an exact-sized element allocation the OOB read is reported as a slab-out-of-bounds; whether the same trigger fires under the production RX path depends on surrounding allocator state. Advance the cursor only when the current TID has a map present.
CVE-2026-64223
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-64223
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "8f500fbc6c655976c8062b1f1e55bd0b3095d6c2",
"lessThan": "f7d395dc5008168ac5b9c1ac2791e59a6078cca1",
"versionType": "git"
},
{
"status": "affected",
"version": "8f500fbc6c655976c8062b1f1e55bd0b3095d6c2",
"lessThan": "2dd9304727c7041df0a599595910bdbe02ad03c5",
"versionType": "git"
},
{
"status": "affected",
"version": "8f500fbc6c655976c8062b1f1e55bd0b3095d6c2",
"lessThan": "2becaaeebe230ade1fcd5d0f1cde4d6ee93ec78f",
"versionType": "git"
},
{
"status": "affected",
"version": "8f500fbc6c655976c8062b1f1e55bd0b3095d6c2",
"lessThan": "a6e6ccd5bd07155c2add6c74ce1a5e68ad3b95ea",
"versionType": "git"
}
],
"programFiles": [
"net/mac80211/mlme.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.9",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.12.92",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.34",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.0.11",
"versionType": "semver",
"lessThanOrEqual": "7.0.*"
},
{
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/mac80211/mlme.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-64223
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #40977 · Revision 1
- Added to Heist Feed
- Publisher date