UBUNTU-CVE-2026-68472: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate EHT MLE before MLD ID read cfg80211gennewie() copies ML probe response elements from the parent frame when the parent EHT multi-link element has an MLD ID matching the nontransmitted BSSID index. The code only checked that the extension element had more than one byte before calling ieee80211mlegetmldid(). That helper assumes a BASIC MLE with enough common info and documents that callers must first use ieee80211mletypeok(). Attack chain: malicious AP sends a short EHT MLE in an MBSSID beacon. cfg80211informbssframedata() stores the copied IE buffer. cfg80211parsembssiddata() builds the nontransmitted BSS IE. cfg80211gennewie() sees the EHT MLE in the parent frame. ieee80211mlegetmldid() then reads past the IE boundary. Validate the MLE type and size before reading the MLD ID. This matches the contract required by the MLE helper and rejects the short element before any internal MLE fields are accessed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Compensating control
In cfg80211_gen_new_ie(), validate the EHT MLE type and ensure it has sufficient size before calling ieee80211_mle_get_mld_id(); use ieee80211_mle_type_ok() before reading the MLD ID.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the affected Ubuntu Linux kernel packages are exposed when they process Wi-Fi management traffic from nearby access points. The attack chain specifically requires a malicious access point to send an MBSSID beacon containing a short EHT multi-link element.
Does exploiting this require credentials or user interaction?
No. The reported vector is adjacent-network access, with no privileges or user interaction required. An attacker must be within Wi-Fi radio range and able to transmit the crafted beacon traffic.
What is the impact of successful exploitation?
The vulnerability causes an out-of-bounds read while the kernel processes the crafted EHT multi-link element. The supplied severity vector indicates high confidentiality impact and high availability impact, with no integrity impact.
How can I determine whether a system may be affected?
Check whether the system runs one of the listed Ubuntu kernel package families and whether it uses Wi-Fi in range of potentially untrusted access points. The vulnerable path is reached while handling MBSSID beacon data containing EHT multi-link elements.