CVE-2026-68402

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: bound element ID read when checking non-inheritance

cfg80211_is_element_inherited() reads the first data octet of the

candidate element (id = elem->data[0]) to look it up in an extension

non-inheritance list. It does so after testing elem->id, but without

verifying that the element actually has a data octet. A zero-length

extension element (WLAN_EID_EXTENSION with length 0) therefore makes it

read one octet past the end of the element.

_ieee802_11_parse_elems_full() runs this check for every element of a

frame once a non-inheritance context exists -- e.g. while parsing a

per-STA profile of a Multi-Link element in a (re)association response,

or a non-transmitted BSS profile -- so a crafted frame from an AP can

trigger a one-octet slab-out-of-bounds read during element parsing:

BUG: KASAN: slab-out-of-bounds in cfg80211_is_element_inherited

Read of size 1 ... in net/wireless/scan.c

Return early (

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References