CVE-2026-74336

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: bound S1G TIM PVB walk to the TIM element

ieee80211_s1g_check_tim() parses the S1G Partial Virtual Bitmap (PVB) of a

received TIM element. The TIM is handed in as the element payload:

ieee802_11_parse_elems_full() stores elems->tim = elem->data and

elems->tim_len = elem->datalen (net/mac80211/parse.c), so the valid bytes

are [tim, tim + tim_len).

When walking the encoded blocks the function passes the walker an end

sentinel of (const u8 *)tim + tim_len + 2, i.e. two bytes past the end of

the element. ieee80211_s1g_find_target_block() loops while (ptr + 1 <= end)

and dereferences ptr (and the per-mode ieee80211_s1g_len_*() helpers read

*ptr), so it can read up to two bytes beyond the TIM element -- an

out-of-bounds read of adjacent skb/heap data when the TIM is the last

element in the frame. The +2 appears to account for the element id/len

header, but tim already points past that header at the element

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References