{"id":"CVE-2026-68402","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-68402","summary":"wifi: cfg80211: bound element ID read when checking non-inheritance","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: bound element ID read when checking non-inheritance\n\ncfg80211_is_element_inherited() reads the first data octet of the\ncandidate element (id = elem->data[0]) to look it up in an extension\nnon-inheritance list. It does so after testing elem->id, but without\nverifying that the element actually has a data octet. A zero-length\nextension element (WLAN_EID_EXTENSION with length 0) therefore makes it\nread one octet past the end of the element.\n\n_ieee802_11_parse_elems_full() runs this check for every element of a\nframe once a non-inheritance context exists -- e.g. while parsing a\nper-STA profile of a Multi-Link element in a (re)association response,\nor a non-transmitted BSS profile -- so a crafted frame from an AP can\ntrigger a one-octet slab-out-of-bounds read during element parsing:\n\n  BUG: KASAN: slab-out-of-bounds in cfg80211_is_element_inherited\n  Read of size 1 ... in net/wireless/scan.c\n\nReturn early (treat the element as inherited) when an extension element\ncarries no data, mirroring the existing handling of empty ID lists.\n\nThe bug was found by fuzzing ieee802_11_parse_elems_full() under KASAN.","published":"2026-08-10T12:04:22.113Z","modified":"2026-08-14T04:03:32.253843513Z","cvss":{"score":7.1,"severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Linux","name":"Kernel","fixedVersion":"6.6.148"}],"fix":null,"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/11ac7a5e75f5132f1778e0c60981d30dc29fb869"},{"type":"WEB","url":"https://git.kernel.org/stable/c/20c308d9a57722801961f816395bf825f7bde6bc"},{"type":"WEB","url":"https://git.kernel.org/stable/c/84bd907361c56fbd5523eceb2682cb39da059bd5"},{"type":"WEB","url":"https://git.kernel.org/stable/c/cb8afea4655ff004fa7feee825d5c79783525383"},{"type":"WEB","url":"https://git.kernel.org/stable/c/ddf2773bcc8e49a43c561f22ec1e7924215d7947"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68402.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68402"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-14T04:03:32.253843513Z"}}