CVE-2026-64030: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: bounds-check linkid in ieee80211mlepcs
IEEE80211MLESTAEPCSCONTROLLINKID is 0x000f, so linkid extracted from a PRIOACCESS ML element PERSTAPROFILE subelement can be 0..15. sdata->link[] has IEEE80211MLDMAXNUMLINKS (15) entries (indices 0..14), making index 15 out-of-bounds.
A connected WiFi 7 AP can trigger this by sending an EPCS Enable Response action frame with a PERSTAPROFILE subelement where linkid = 15. The unsolicited-notification path (dialogtoken = 0) is reachable any time EPCS is already enabled, without any prior client request.
sdata->link[15] reads into the first word of sdata->activatelinkswork (a wiphywork whose embedded listhead is non-NULL after INITLISTHEAD), so the NULL check on the result does not catch the invalid access. The garbage pointer is then passed to ieee80211stawmmparams(), which dereferences link->sdata and crashes the kernel.
The same class of bug was fixed for ieee80211mlreconfiguration() by commit 162d331d833d ("wifi: mac80211: bounds-check linkid in ieee80211mlreconfiguration").
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel mac80211to a version that resolves this vulnerability.Patch 162d331d833d
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64030?
CVE-2026-64030 has a risk score of 72, indicating a high severity vulnerability.
How do I fix CVE-2026-64030?
To fix CVE-2026-64030, update your Linux kernel to the latest version where this vulnerability has been resolved.
What systems are affected by CVE-2026-64030?
CVE-2026-64030 affects systems running the Linux kernel with implementations of the mac80211 subsystem.
What type of vulnerability is CVE-2026-64030?
CVE-2026-64030 is a bounds-checking vulnerability within the ieee80211_ml_epcs function in the Linux kernel.
Can CVE-2026-64030 lead to arbitrary code execution?
CVE-2026-64030 may potentially lead to a denial of service or other unintended behaviors in the affected software.