CVE-2026-23246: wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: bounds-check linkid in ieee80211mlreconfiguration
linkid is taken from the ML Reconfiguration element (control & 0x000f), so it can be 0..15. linkremovaltimeout[] has IEEE80211MLDMAXNUMLINKS (15) elements, so index 15 is out-of-bounds. Skip subelements with linkid >= IEEE80211MLDMAXNUMLINKS to avoid a stack out-of-bounds write.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Compensating control
In ieee80211_ml_reconfiguration, skip subelements with link_id >= IEEE80211_MLD_MAX_NUM_LINKS to prevent an out-of-bounds write to link_removal_timeout[].
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23246?
CVE-2026-23246 has been classified with a moderate severity due to potential information disclosure and denial-of-service risks.
How do I fix CVE-2026-23246?
To fix CVE-2026-23246, users should update their Linux kernel to the patched version that addresses the bounds-check issue.
What are the potential impacts of CVE-2026-23246?
The impacts of CVE-2026-23246 may include system crashes or undefined behavior when handling specific ML Reconfiguration elements.
Which versions of the Linux kernel are affected by CVE-2026-23246?
CVE-2026-23246 affects specific versions of the Linux kernel that utilize the mac80211 module for Wi-Fi functionalities.
Is CVE-2026-23246 currently being exploited in the wild?
As of the latest updates, there have been no confirmed reports of CVE-2026-23246 being actively exploited.