Skip to main content

Linux Kernel CVE-2026-64117

| EUVDEUVD-2026-45802 HIGH
Use After Free (CWE-416)
2026-07-19 Linux GHSA-8c2f-6crq-prr9
Information Disclosure Linux Use After Free Memory Corruption
8.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.8 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
5.9 MEDIUM

Adjacent WiFi vector; AC:H because it requires non-default 802.11s mesh config and the no-route branch; freed-memory read gives limited info disclosure (C:L) and reliable crash (A:H), not confirmed RCE.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
4.0 AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 17:33 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
8.8 (HIGH)
Patch available
Jul 19, 2026 - 17:03 EUVD
CVE Published
Jul 19, 2026 - 15:40 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 19, 2026 - 15:40 cve.org
HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb

ieee80211_invoke_fast_rx() reads RX status through IEEE80211_SKB_RXCB(skb), which aliases the same skb->cb storage that ieee80211_rx_mesh_data() reuses as IEEE80211_TX_INFO. In the unicast forward path, mesh_data does:

info = IEEE80211_SKB_CB(fwd_skb); memset(info, 0, sizeof(*info));

on the same skb the caller still names via rx->skb, then either queues the skb for TX (success) or kfree_skb()'s it (no-route) before returning RX_QUEUED. The caller's RX_QUEUED arm then calls sta_stats_encode_rate(status) on memory that is either zeroed (success path) or freed (no-route path). The latter is KASAN slab-use-after-free in ieee80211_prepare_and_rx_handle.

Fix by encoding the rate from status before invoking ieee80211_rx_mesh_data(), so the RX_QUEUED arm consumes a value captured while status was still backed by valid memory.

AnalysisAI

Memory corruption (slab use-after-free) in the Linux kernel's mac80211 wireless stack allows an adjacent attacker on an 802.11s mesh network to trigger a KASAN-detected use-after-free in the fast-RX receive path. When a unicast frame is forwarded by mesh_data and hits the no-route path, the shared skb->cb storage is freed (or zeroed) before the RX_QUEUED handler reads rate statistics from it via sta_stats_encode_rate, corrupting kernel memory. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.16%, 6th percentile); the issue is a fixed upstream bug rather than an actively exploited one.

Technical ContextAI

The flaw lives in Linux's mac80211 software MAC layer for SoftMAC WiFi drivers, specifically the receive fast-path (ieee80211_invoke_fast_rx) and mesh forwarding (ieee80211_rx_mesh_data). The root cause is a classic use-after-free / storage-aliasing bug (CWE-416, though the record lists CWE as N/A): the socket buffer control block (skb->cb) is aliased between IEEE80211_SKB_RXCB (RX status) and IEEE80211_SKB_CB (IEEE80211_TX_INFO). In the unicast mesh forward path, ieee80211_rx_mesh_data() memsets that TX_INFO to zero over the same buffer the caller still references as rx->skb, then either queues the skb for transmit (success) or kfree_skb()'s it (no-route) before returning RX_QUEUED. The caller's RX_QUEUED arm subsequently calls sta_stats_encode_rate(status) on memory that is either zeroed or already freed. The fix captures the encoded rate from status before invoking ieee80211_rx_mesh_data(), so the value is read while the memory is still valid. The CPE data identifies the affected product simply as cpe:2.3:a:linux:linux, i.e. the kernel itself.

RemediationAI

Upstream fix available via stable-tree commits 2fb64f94f9afb774f2fa0c7835727d7a67f89f07 and d71c841be5d9e586ee7f36c0dc8ed4db0d9a1349 (https://git.kernel.org/stable/c/2fb64f94f9afb774f2fa0c7835727d7a67f89f07 and https://git.kernel.org/stable/c/d71c841be5d9e586ee7f36c0dc8ed4db0d9a1349); update to the patched stable release for your kernel series (the EUVD data cites the 7.0.x/7.1 and 6.4 branches - confirm the exact tagged version for your distribution before deploying). Apply the patch through your distribution's kernel update channel and reboot. If patching must be deferred, the most effective compensating control is to disable 802.11s mesh mode / mesh forwarding on affected wireless interfaces (e.g. tear down the mesh point interface), since the vulnerable code path is only exercised during unicast mesh forwarding - the trade-off is loss of mesh connectivity on that node. Where mesh is not needed at all, ensuring interfaces run only in station/AP mode avoids the path entirely.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-64117 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy