Linux CVE-2026-23246

Attacker must be on the same network segment (AV:A) to send a crafted ML Reconfiguration element with link_id=15 to a Linux system running vulnerable kernel versions with mac80211 WiFi stack enabled. No authentication or user interaction required.

Although CVSS and EPSS scores are not provided by the data sources, this vulnerability exhibits high real-world risk due to several factors. First, it is a stack out-of-bounds write triggered by untrusted network input (WiFi frames), which historically enables both DoS and code execution. Second, the attack vector is network-adjacent (any WiFi capable device in range), requiring no authentication or special privileges, lowering attack complexity significantly. Third, patches are publicly available across multiple kernel branches (6.12.77, 6.18.17, 6.19.7, 7.0-rc2), indicating the Linux maintainers treat this as a priority fix. Fourth, affected versions span widely-deployed LTS kernels (Linux 6.5 and later), affecting a large installed base of servers, IoT devices, and embedded systems. The lack of published EPSS or KEV data does not diminish the technical risk; rather, it reflects the recency of the vulnerability (CVE-2026-* prefix suggests late 2025 or early 2026 disclosure). The presence of four distinct commit links in the kernel.org stable branch indicates active remediation across multiple concurrent kernel versions, a pattern reserved for high-priority bugs. Given the network-adjacent attack vector, memory corruption nature, and kernel-level scope, this should be treated as a critical priority for patching.

An attacker positioned within WiFi range of a target device (e.g., nearby café, parking lot) crafts a malicious IEEE 802.11 management frame containing an ML Reconfiguration element with link_id set to 15 (0xF). Upon receipt, the vulnerable kernel's ieee80211_ml_reconfiguration function processes this frame without bounds-checking, writing to link_removal_timeout[15], which is out-of-bounds for the 15-element array. This write corrupts adjacent stack memory, potentially overwriting saved return addresses or other critical stack data. A sophisticated attacker can trigger a kernel panic (DoS) or, with careful payload crafting, corrupt nearby stack structures to achieve code execution in kernel context. No sophisticated tools or exploits need to be publicly available; any attacker with basic WiFi frame generation capability (using standard Linux tools like hostapd or aircrack-ng modifications) can trigger the vulnerability on unpatched systems within WiFi range.