Linux Kernel CVE-2026-64574

Exploitation requires all of the following to be true simultaneously: (1) the target system must have an MLO-capable WiFi 7 (IEEE 802.11be) network interface with a kernel-space MLO driver loaded (e.g., Intel BE200 series, MediaTek WiFi 7 chipsets); (2) the running kernel must include MLO vif link-update support introduced at commit 170cd6a66d9a and must not have been patched to 6.6.148, 6.12.101, 6.18.42, 7.1.6, or 7.2-rc5; (3) the attacker must hold local access with sufficient capability to configure WiFi interfaces, typically CAP_NET_ADMIN, which on desktop distributions may be delegated to members of the 'netdev' group; (4) the attacker must be able to trigger a drv_change_vif_links() failure during a link-add operation, which occurs on internal firmware command, queue, or allocation failures in the MLO driver; (5) the debugfs filesystem must be mounted and readable by the attacker, which is the default on most Linux distributions. Limiting factors include: no remote exploitation path (AV:L strictly), requirement for specific WiFi 7 hardware not yet universally deployed, CAP_NET_ADMIN gating, and the practical difficulty of reliably inducing a drv_change_vif_links() failure on demand, which may require race conditions or resource exhaustion beyond what AC:L implies.

CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high impact but a strictly local attack vector requiring low-privilege access, which substantially limits its reach compared to network-exploitable flaws at the same score. EPSS is 0.16% at the 5th percentile, a very low exploitation probability indicating no observed widespread in-the-wild use. This CVE is not listed in the CISA KEV catalog, and no public proof-of-concept exploit has been identified at time of analysis. Real-world risk is further gated by the requirement for MLO-capable WiFi 7 hardware - a relatively modern and not yet ubiquitous component - and an unpatched kernel in the 6.4-7.1.x range, narrowing the realistic attack surface considerably. However, for affected systems (e.g., modern laptops with WiFi 7 NICs running current mainline or stable kernels), a local low-privilege attacker achieving kernel panic (A:H) or, with heap manipulation, controlled memory corruption (C:H/I:H) represents full system compromise. The CVSS AC:L rating assumes reliable trigger of drv_change_vif_links() failure; if inducing that firmware or allocation failure requires race conditions or resource exhaustion, practical complexity is higher than AC:L implies - this is an unresolved ambiguity in the available data. The advisory's KASAN trace referencing 'exploit/145' strongly implies deliberate exploit research, but no weaponized code is publicly available.

A local attacker with low-privilege shell access on a WiFi 7-capable Linux system uses standard netlink WiFi management calls to configure an MLO virtual interface, then induces a drv_change_vif_links() failure through firmware resource exhaustion or allocation pressure. The error path frees the new link containers without removing their debugfs entries, leaving file->private_data dangling. The attacker then reads from the stale debugfs entry at /sys/kernel/debug/ieee80211/.../link-1/txpower, causing ieee80211_if_read_link() to dereference the freed container, resulting in a KASAN slab-use-after-free, kernel panic, or - with heap grooming - controlled kernel memory read/write for privilege escalation. No public proof-of-concept is available, but the KASAN crash trace in the advisory explicitly names the triggering task 'exploit/145', confirming the scenario was validated by the reporter.