Linux CVE-2026-23246

This vulnerability resides in the Linux kernel's mac80211 subsystem, which implements IEEE 802.11 WiFi protocol handling. Specifically, the ieee80211_ml_reconfiguration function processes the ML (Multi-Link) Reconfiguration element from incoming WiFi management frames during WiFi mesh or multi-link device operations. The CWE classification is Buffer Overflow (implicit from 'stack out-of-bounds write'). The root cause is that link_id is extracted from an untrusted protocol field (control & 0x000f) without validation, yielding values 0-15. However, the link_removal_timeout array is allocated with only IEEE80211_MLD_MAX_NUM_LINKS (15) elements, meaning valid indices are 0-14. When link_id equals 15, the code writes out-of-bounds to the stack, corrupting adjacent memory and potentially enabling privilege escalation or denial of service attacks via crafted wireless frames received by any device running vulnerable kernel versions.