CVE-2026-23246

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration

link_id is taken from the ML Reconfiguration element (control & 0x000f), so it can be 0..15. link_removal_timeout[] has IEEE80211_MLD_MAX_NUM_LINKS (15) elements, so index 15 is out-of-bounds. Skip subelements with link_id >= IEEE80211_MLD_MAX_NUM_LINKS to avoid a stack out-of-bounds write.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-129

Affected software

VendorProductVersions
LinuxLinux>= 8eb8dd2ffbbb6b0b8843b66754ee9f129f1b2d6c, < 650981e718e68005ca2760a6358134b8a98ebea4; >= 8eb8dd2ffbbb6b0b8843b66754ee9f129f1b2d6c, < bfde158d5d1322c0c2df398a8d1ccce04943be2e; >= 8eb8dd2ffbbb6b0b8843b66754ee9f129f1b2d6c, < f35ceec54d48e227fa46f8f97fd100a77b8eab15; >= 8eb8dd2ffbbb6b0b8843b66754ee9f129f1b2d6c, < d58d71c2167601762351962b9604808d3be94400; >= 8eb8dd2ffbbb6b0b8843b66754ee9f129f1b2d6c, < 162d331d833dc73a3e905a24c44dd33732af1fc5
LinuxLinux6.5

References

Timeline

Published
Mar 18, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-232475.5In the Linux kernel, the following vulnerability has been resolved: tcp: secure_seq: add back ports to TS offset This reverts 28ee1b746f49CVE-2026-232487.8In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix refcount bug and potential UAF in perf_mmap Syzkaller rCVE-2026-232495.5In the Linux kernel, the following vulnerability has been resolved: xfs: check for deleted cursors when revalidating two btrees The free sCVE-2026-23256.5Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail to limit the size of the request body on the start meeting CVE-2026-232505.5In the Linux kernel, the following vulnerability has been resolved: xfs: check return value of xchk_scrub_create_subord Fix this function CVE-2026-232515.5In the Linux kernel, the following vulnerability has been resolved: xfs: only call xf{array,blob}_destroy if we have a valid pointer Only CVE-2026-232525.5In the Linux kernel, the following vulnerability has been resolved: xfs: get rid of the xchk_xfile_*_descr calls The xchk_xfile_*_descr maCVE-2026-232537.8In the Linux kernel, the following vulnerability has been resolved: media: dvb-core: fix wrong reinitialization of ringbuffer on reopen dvCVE-2026-232545.5In the Linux kernel, the following vulnerability has been resolved: net: gro: fix outer network offset The udp GRO complete stage assumes CVE-2026-232555.5In the Linux kernel, the following vulnerability has been resolved: net: add proper RCU protection to /proc/net/ptype Yin Fengwei reportedCVE-2026-232565.5In the Linux kernel, the following vulnerability has been resolved: net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup CVE-2026-232575.5In the Linux kernel, the following vulnerability has been resolved: net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup