Linux Kernel CVE-2026-68470

The vulnerability resides in the Linux kernel's mac80211 subsystem, which implements the IEEE 802.11 (WiFi) MAC layer in software for a wide range of wireless hardware drivers. IEEE 802.11 extension frames use a distinct header layout where the extension element occupies the same byte offset as regular 802.11 frame header fields - but with an entirely different structure and semantics. The mac80211 generic RX path includes helper functions and interface dispatch code that dereference regular header fields such as source, destination, and BSSID MAC addresses. Prior to this fix, unsupported extension subtypes (anything other than S1G beacons) were not dropped early in the receive pipeline, allowing them to reach these helpers and cause reads at incorrect offsets. For the one supported subtype (S1G Sub-1 GHz beacons), the fix additionally linearizes the socket buffer (SKB), validates the fixed S1G beacon header including optional fixed fields indicated by frame control, routes processing through the station/default-link path, and makes ieee80211_get_bssid() length-safe before returning the S1G source-address pointer. The root cause class, while not formally assigned a CWE in the input data, is type confusion combined with insufficient input validation - extension frame payloads were processed by code that assumed a regular 802.11 header structure. Fix commits are available at https://git.kernel.org/stable/c/57d503ce32eccfa7650065ca4c560f7e29a2e676 and https://git.kernel.org/stable/c/625fc704b19cb48d7d269ad54ffffb4d3bf9c7ed.