CVE-2026-64030

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs

IEEE80211_MLE_STA_EPCS_CONTROL_LINK_ID is 0x000f, so link_id extracted

from a PRIO_ACCESS ML element PER_STA_PROFILE subelement can be 0..15.

sdata->link[] has IEEE80211_MLD_MAX_NUM_LINKS (15) entries (indices 0..14),

making index 15 out-of-bounds.

A connected WiFi 7 AP can trigger this by sending an EPCS Enable Response

action frame with a PER_STA_PROFILE subelement where link_id = 15. The

unsolicited-notification path (dialog_token = 0) is reachable any time

EPCS is already enabled, without any prior client request.

sdata->link[15] reads into the first word of sdata->activate_links_work

(a wiphy_work whose embedded list_head is non-NULL after INIT_LIST_HEAD),

so the NULL check on the result does not catch the invalid access. The

garbage pointer is then passed to ieee80211_sta_wmm_params(), which

dereferences link->sdata and crashes the kernel.

The same

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References