EUVD-2026-39208
GHSA-gff8-2g4x-324x
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local vector since triggering requires system presence and driver interaction; PR:L for minimal local account; availability-only impact as the outcome is exclusively a kernel crash with no data exposure.
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
5DescriptionNVD
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: enforce HE/EHT cap/oper consistency
Xiang Mei reports that mac80211 could crash if eht_cap is set but eht_oper isn't. Rather than fixing that for the individual user(s), enforce that both HE/EHT have consistent elements.
AnalysisAI
Kernel crash in Linux cfg80211 WiFi subsystem occurs when EHT (Wi-Fi 7 / 802.11be) capability elements are present without matching EHT operation elements, triggering a null pointer dereference in mac80211 and causing a denial of service. Systems running affected kernel versions with Wi-Fi 7 hardware are at risk of a local-privilege kernel panic with no confidentiality or integrity impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The vulnerability requires a local session with at least low-privilege access (PR:L per CVSS vector) on a system running a vulnerable Linux kernel version. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H at 5.5 Medium accurately reflects the constrained blast radius: exploitation requires local access with at minimum a low-privilege account, limits impact to availability only (kernel crash), and has no scope change. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user with a low-privilege account on a Linux system equipped with Wi-Fi 7 hardware triggers an inconsistent kernel state where eht_cap is set but eht_oper is absent - potentially by receiving a crafted AP beacon or through driver-level interaction - causing mac80211 to dereference a null pointer and crash the kernel, taking down all processes on the host. No public proof-of-concept has been identified at time of analysis. … |
| Remediation | The primary fix is to upgrade to Linux kernel 7.0.13 or the patched 7.1 mainline release, applying stable commits 0f5e9ddd7e8e7758771a63cdd498a2007dc8da7a and cb9959ab5f99611d27a06586add84811fe8102dc (available at https://git.kernel.org/stable/c/). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today