CVE-2026-64117: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb
ieee80211invokefastrx() reads RX status through IEEE80211SKBRXCB(skb), which aliases the same skb->cb storage that ieee80211rxmeshdata() reuses as IEEE80211TXINFO. In the unicast forward path, meshdata does:
info = IEEE80211SKBCB(fwdskb); memset(info, 0, sizeof(info));
on the same skb the caller still names via rx->skb, then either queues the skb for TX (success) or kfreeskb()'s it (no-route) before returning RXQUEUED. The caller's RXQUEUED arm then calls stastatsencoderate(status) on memory that is either zeroed (success path) or freed (no-route path). The latter is KASAN slab-use-after-free in ieee80211prepareandrxhandle.
Fix by encoding the rate from status before invoking ieee80211rxmeshdata(), so the RXQUEUED arm consumes a value captured while status was still backed by valid memory.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: capture fast-RX rate before mesh reuses skb-cb
ieee80211invokefastrx() reads RX status through IEEE80211SKBRXCB(skb), which aliases the same skb-cb storage that ieee80211rxmeshdata() reuses as IEEE80211TXINFO. In the unicast forward path, meshdata does:
info = IEEE80211SKBCB(fwdskb); memset(info, 0, sizeof(info));
on the same skb the caller still names via rx-skb, then either queues the skb for TX (success) or kfreeskb()'s it (no-route) before returning RXQUEUED. The caller's RXQUEUED arm then calls stastatsencoderate(status) on memory that is either zeroed (success path) or freed (no-route path). The latter is KASAN slab-use-after-free in ieee80211prepareandrxhandle.
Fix by encoding the rate from status before invoking ieee80211rxmeshdata(), so the RXQUEUED arm consumes a value captured while status was still backed by valid memory.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Capture and encode the fast-RX rate from valid RX status before invoking ieee80211_rx_mesh_data() or otherwise reusing the skb->cb storage; ensure the RX_QUEUED path does not call sta_stats_encode_rate(status) after the status memory has been zeroed or freed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64117?
The severity of CVE-2026-64117 is classified as high with a CVSS score of 8.8.
How do I fix CVE-2026-64117?
To fix CVE-2026-64117, users should update to the latest version of the Linux kernel where the vulnerability has been patched.
What type of vulnerability is CVE-2026-64117?
CVE-2026-64117 is classified as a Use After Free vulnerability in the Linux kernel.
What impact does CVE-2026-64117 have on systems?
CVE-2026-64117 may allow an attacker to exploit memory corruption issues, leading to potential denial of service or unauthorized access.
Which software is affected by CVE-2026-64117?
CVE-2026-64117 affects the Linux kernel, specifically the wifi mac80211 components.