CVE-2026-64223

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: consume only present negotiated TTLM maps

ieee80211_tid_to_link_map_size_ok() validates negotiated TTLM elements

against the number of link-map entries indicated by link_map_presence.

ieee80211_parse_neg_ttlm() must consume the same layout.

The parser advanced its cursor for every TID, including TIDs whose

presence bit is clear and therefore have no map bytes in the element.

A sparse map can then make a later present TID read past the validated

element.

The bad bytes land in neg_ttlm->{up,down}link[tid] but are gated by

valid_links before being applied to driver state, so a peer cannot

turn the read into a policy change. Under KUnit + KASAN with an

exact-sized element allocation the OOB read is reported as a

slab-out-of-bounds; whether the same trigger fires under the

production RX path depends on surrounding allocator state.

Advance the cursor only when the current TID has a map present.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References