CVE-2026-68470

HighCVSS 8.8/10Last modified Oct 21, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: validate extension-frame layout before RX

Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can still reach helpers and interface dispatch code that read regular header address fields before unsupported extension subtypes are dropped.

mac80211 currently only handles S1G beacon extension frames. Drop other extension subtypes before they can reach regular-header RX processing. For S1G beacons, linearize the SKB with the management-frame path and require the fixed S1G beacon header, including optional fixed fields indicated by frame control, before generic RX dispatch.

Route S1G beacons through the station/default-link RX path without regular-header station lookup. Avoid regular-header address reads in the mac80211 RX paths that process S1G extension beacons, including accept-frame, duplicate-detection, address-copy, and MLO address-translation paths.

Also make ieee80211_get_bssid() length-safe before returning the S1G source-address pointer.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 09a740ce352e1a1d16b9984115514ba9a4f4704b, < 7aba69b611007e11b9b93118ff8fe88998c3107f; >= 09a740ce352e1a1d16b9984115514ba9a4f4704b, < 1c3d9c6bd5b795f3b952b40d574c8e424e14a39b; >= 09a740ce352e1a1d16b9984115514ba9a4f4704b, < 625fc704b19cb48d7d269ad54ffffb4d3bf9c7ed; >= 09a740ce352e1a1d16b9984115514ba9a4f4704b, < 57d503ce32eccfa7650065ca4c560f7e29a2e676
LinuxLinux5.10

References

Timeline

Published
Aug 15, 2026
Last modified
Oct 21, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-684718.8In the Linux kernel, the following vulnerability has been resolved: wifi: ieee80211: validate MLE common info length ieee80211_mle_common_CVE-2026-684728.1In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate EHT MLE before MLD ID read cfg80211_gen_new_iCVE-2026-684737.8In the Linux kernel, the following vulnerability has been resolved: powerpc/uaccess: correct check for CONFIG_PPC_E500 in mask_user_addressCVE-2026-684747.8In the Linux kernel, the following vulnerability has been resolved: powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access() spuCVE-2026-68475In the Linux kernel, the following vulnerability has been resolved: reset: sunxi: fix memory region leak on ioremap failure In sunxi_resetCVE-2026-684769.8In the Linux kernel, the following vulnerability has been resolved: ipvs: reload ip header after head reallocation __ip_vs_get_out_rt() caCVE-2026-684779.8In the Linux kernel, the following vulnerability has been resolved: ipvs: fix more places with wrong ipv6 transport offsets Sashiko reportCVE-2026-68478In the Linux kernel, the following vulnerability has been resolved: memstick: ms_block: reject a card that reports too many blocks msb_ftlCVE-2026-684797.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: validate firmware patch bounds rtlbt_parse_firmware(CVE-2026-68488.1A flaw was found in Red Hat Quay. When Red Hat Quay requests password re-verification for sensitive operations, such as token generation or CVE-2026-68480In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Make Safe-RET robust against interrupt injection An attackerCVE-2026-684817.5In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports
CVE-2026-68470: High severity, CVSS 8.8 | Vulnix