CVE-2026-64174

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: advance loop vars in cfg80211_merge_profile()

cfg80211_merge_profile() reassembles a Multi-BSSID non-transmitted BSS

profile that has been split across multiple consecutive MBSSID elements.

Its while-loop calls

cfg80211_get_profile_continuation(ie, ielen, mbssid_elem, sub_elem)

but never advances mbssid_elem or sub_elem inside the body. Each

iteration therefore searches for a continuation that follows the same

fixed pair; the helper returns the same next_mbssid; and the same

next_sub bytes are memcpy()'d into merged_ie at a growing offset until

the buffer fills.

Advance both mbssid_elem and sub_elem to the just-consumed continuation

so the next call to cfg80211_get_profile_continuation() searches for a

further continuation beyond it (or returns NULL when none exists).

A specially-crafted malicious beacon can take advantage of this bug

to cause the kernel to spend an excessive amount of time in

c

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References