Skip to main content

Linux Kernel CVE-2026-64174

| EUVDEUVD-2026-45859 MEDIUM
2026-07-19 Linux GHSA-rrg8-qcw5-j3cm
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
6.5 MEDIUM

Beacon frames are broadcast over the air requiring only adjacent-network proximity (AV:A) and no victim-side credentials (PR:N); impact is strictly availability with no confidentiality or integrity component.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.3 MEDIUM
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Red Hat
7.0 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 13, 2026 - 16:16 vuln.today
CVSS changed
Aug 13, 2026 - 15:37 NVD
5.5 (MEDIUM)
Patch available
Jul 19, 2026 - 17:03 EUVD
CVE Published
Jul 19, 2026 - 15:40 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 19, 2026 - 15:40 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: advance loop vars in cfg80211_merge_profile()

cfg80211_merge_profile() reassembles a Multi-BSSID non-transmitted BSS profile that has been split across multiple consecutive MBSSID elements. Its while-loop calls

cfg80211_get_profile_continuation(ie, ielen, mbssid_elem, sub_elem)

but never advances mbssid_elem or sub_elem inside the body. Each iteration therefore searches for a continuation that follows the same fixed pair; the helper returns the same next_mbssid; and the same next_sub bytes are memcpy()'d into merged_ie at a growing offset until the buffer fills.

Advance both mbssid_elem and sub_elem to the just-consumed continuation so the next call to cfg80211_get_profile_continuation() searches for a further continuation beyond it (or returns NULL when none exists).

A specially-crafted malicious beacon can take advantage of this bug to cause the kernel to spend an excessive amount of time in cfg80211_merge_profile (up to as much as 2ms per beacon received), which could theoretically be abused in some way.

AnalysisAI

CPU exhaustion in the Linux kernel's cfg80211 WiFi subsystem allows an attacker within radio range to trigger a runaway loop in cfg80211_merge_profile() by broadcasting a specially crafted Multi-BSSID beacon frame, consuming up to 2 milliseconds of kernel CPU time per beacon received. Devices running Linux 5.2 and later with cfg80211-based WiFi drivers are affected across eight stable kernel branches, from 5.10.x through 7.0.x, until patched. No public exploit has been identified at time of analysis, and EPSS probability is 0.17% at the 7th percentile, indicating no observed active exploitation.

Technical ContextAI

Multi-BSSID, introduced in IEEE 802.11ax (Wi-Fi 6), allows a single physical access point to advertise multiple virtual BSSIDs within one beacon frame by embedding Non-Transmitted BSS Profile subelements across consecutive MBSSID Information Elements. The Linux kernel's cfg80211 subsystem handles reassembly of these split profiles in cfg80211_merge_profile(). The bug is a missing loop cursor advancement: the while-loop calls cfg80211_get_profile_continuation(ie, ielen, mbssid_elem, sub_elem) each iteration but never advances mbssid_elem or sub_elem afterward, so each call searches from the same fixed pair, returns the same next_mbssid pointer, and memcpy()s the same continuation bytes into the merged_ie output buffer at a growing offset until the buffer is exhausted. This is structurally a CWE-835 (Loop with Unreachable Exit Condition) or CWE-400 (Uncontrolled Resource Consumption) pattern, though NVD has not assigned a CWE to this entry. The affected CPE is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*, introduced at commit fe806e4992c9047affd263bcc13b2c047029a726 beginning with kernel 5.2.

RemediationAI

The primary remediation is to upgrade to a patched kernel version corresponding to the running stable branch: 5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, or mainline 7.1. Upstream stable fixes are available at the following git.kernel.org stable commits: 5817e1e5205498a5df66eba2b34e817f4210fd0f (5.10 branch), cedbb608494ba1e7a5c6c56b7f1d3fd470094f28, c0bc4c8bd556cbe036a5b9ed333c0aab9aadfcb8, 1ced0f5a851f9cae274545a42a06c459b7fd8881, 67915715fd3874057457363c87c63e18829527df, 6cfae4914439878b8acb35c7e3b40096eeb2ad9c, 1343a480f84b80c1249133a90ef87f8751d65cbb, and 7666dbb1bacc4ba522b96740cba7283d243d16e1. Ubuntu users should apply USN-8575-1 via their distribution's package manager. Where immediate patching is not feasible, disabling the WiFi interface entirely (via 'ip link set wlan0 down' or rfkill) eliminates the attack surface with the trade-off of losing wireless connectivity; alternatively, unloading the cfg80211 and mac80211 kernel modules on systems that do not require wireless removes the vulnerable code path. Restricting interfaces to a single trusted SSID reduces but does not eliminate exposure, as passive beacon scanning can still receive rogue frames.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Micro 6.2 Fixed
openSUSE Leap 16.0 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-64174 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy