UBUNTU-CVE-2026-97518: Medium severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: reject duplicate wiphy cipher suite entries Duplicate entries in wiphy->ciphersuites do not describe any additional capability, but cfg80211 currently accepts them and leaves individual consumers to deal with them. One such consumer is the WEXT compatibility code, which appends a WEP key length for each WEP cipher entry it sees. Repeated WEP entries can therefore overflow the fixed iwrange::encodingsize array returned by SIOCGIWRANGE. Reject duplicate cipher suite entries in wiphyregister() instead. This keeps the cipher suite invariant in one place and makes malformed wiphy descriptions fail early with -EINVAL, rather than relying on a single cfg80211 user to handle duplicates correctly.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
The affected software list includes Ubuntu linux, linux-fips, linux-aws, linux-azure, linux-gcp, and their listed FIPS variants. The overflow path is in the WEXT compatibility handling of the SIOCGIWRANGE request when malformed wireless capability data contains repeated WEP cipher entries.
What access and conditions are required for exploitation?
The supplied vector indicates local access and low privileges are required, with no user interaction. The triggering condition is a wiphy description containing duplicate cipher suite entries, including repeated WEP entries that cause the WEXT code to append too many WEP key lengths.
How can the corrected behavior be identified?
With the resolution applied, wiphy_register() rejects duplicate cipher suite entries early with -EINVAL. This prevents malformed wiphy capability descriptions from reaching consumers such as the WEXT compatibility code.