CVE-2026-74336: wifi: mac80211: bound S1G TIM PVB walk to the TIM element

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: bound S1G TIM PVB walk to the TIM element

ieee80211s1gchecktim() parses the S1G Partial Virtual Bitmap (PVB) of a received TIM element. The TIM is handed in as the element payload: ieee80211parseelemsfull() stores elems->tim = elem->data and elems->timlen = elem->datalen (net/mac80211/parse.c), so the valid bytes are [tim, tim + timlen).

When walking the encoded blocks the function passes the walker an end sentinel of (const u8 )tim + timlen + 2, i.e. two bytes past the end of the element. ieee80211s1gfindtargetblock() loops while (ptr + 1 <= end) and dereferences ptr (and the per-mode ieee80211s1glen() helpers read ptr), so it can read up to two bytes beyond the TIM element -- an out-of-bounds read of adjacent skb/heap data when the TIM is the last element in the frame. The +2 appears to account for the element id/len header, but tim already points past that header at the element payload, so the addend is wrong.

Pass the correct element end, (const u8 )tim + timlen.