Skip to main content

Linux CVE-2026-64223

| EUVDEUVD-2026-48631 HIGH
Out-of-bounds Read (CWE-125)
2026-07-24 Linux GHSA-m9jr-3w64-2f4w
8.1
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.1 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
SUSE
6.5 MEDIUM
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 27, 2026 - 05:24 vuln.today
CVSS changed
Jul 27, 2026 - 05:22 NVD
8.1 (HIGH)
Patch available
Jul 24, 2026 - 17:48 EUVD
CVE Published
Jul 24, 2026 - 15:23 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 24, 2026 - 15:23 cve.org
HIGH 8.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: consume only present negotiated TTLM maps

ieee80211_tid_to_link_map_size_ok() validates negotiated TTLM elements against the number of link-map entries indicated by link_map_presence. ieee80211_parse_neg_ttlm() must consume the same layout.

The parser advanced its cursor for every TID, including TIDs whose presence bit is clear and therefore have no map bytes in the element. A sparse map can then make a later present TID read past the validated element.

The bad bytes land in neg_ttlm->{up,down}link[tid] but are gated by valid_links before being applied to driver state, so a peer cannot turn the read into a policy change. Under KUnit + KASAN with an exact-sized element allocation the OOB read is reported as a slab-out-of-bounds; whether the same trigger fires under the production RX path depends on surrounding allocator state.

Advance the cursor only when the current TID has a map present.

AnalysisAI

We need to produce a JSON object with the specified fields. Let's analyze the data.

CVE ID: CVE-2026-64223 Description: In the Linux kernel, wifi: mac80211: consume only present negotiated TTLM maps. It's an out-of-bounds read due to parsing error in negotiated TTLM elements. The vulnerability is in mac80211 (Linux kernel wireless subsystem). Specifically, ieee80211_parse_neg_ttlm() advances cursor for every TID, even if presence bit is clear, leading to reading past validated element for later present TIDs. The bad bytes land in neg_ttlm->{up,down}link[tid] but gated by valid_links, so a peer cannot turn it into policy change. Under KUnit + KASAN, OOB read reported as slab-out-of-bounds. In production, depends on allocator state. So from the description: It's an out-of-bounds read. Affected product: Linux kernel (specifically mac80211 subcomponent). CVSS score 8.1, vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H -> Adjacent network (WiFi range?), low complexity, no privileges, no user interaction, scope unchanged, high confidentiality and availability impact, no integrity. So it's a read and potentially crash/A impact. EPSS: 0.17% (6th percentile) very low. Patch: Available from vendor (Linux). CPE strings: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* (generic), no version specified in CPE, but EUVD provides affected versions: Linux commits from 8f500fbc6c... up to various fix commits. EUVD versions: Linux 8f500fbc6c... < a6e6ccd5bd... (6.12.92?), etc. Patches: "Linux patch: 6.18.34", "6.12.92", 0, 7.1, 7.0.11? Those look odd: maybe patch versions for stable trees. Anyway, the vulnerability is in mac80211, which is part of the Linux kernel. The affected versions likely include kernels where this commit 8f500fbc... (introduced) until fix commit a6e6ccd5bd..., which appears in various stable trees. I need to synthesize. Product_name: "Linux Kernel" (1-3 words). Actually the specific product is "mac80211" which is part of the Linux kernel's wireless stack. So "Linux Kernel mac80

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2026-64223 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy