Linux Kernel CVE-2026-68471

Exploitation requires the attacker to be physically adjacent or connected to the same wireless network segment as the target - AV:A rules out remote internet-based attack. The target host must be running an affected kernel version (from commit 0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada1 onward, unpatched to 6.18.40/7.1.5/7.2-rc4) and must have the mac80211/ieee80211 WiFi stack loaded and active, which requires WiFi hardware to be present and in use. The vulnerability is triggered during parsing of received IEEE 802.11 management frames containing Reconfiguration or Priority Access MLE subtypes - features part of the 802.11be (WiFi 7) standard; environments without WiFi 7 capable hardware or drivers may not process these MLE types at all. No authentication is required (PR:N). No user interaction is required (UI:N). Exploitation is limited by the requirement for physical/network proximity and by modern kernel exploit mitigations (KASLR, SMEP, SMAP) that raise the bar beyond triggering the initial bounds violation.

CVSS 8.8 with AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H signals a high-severity flaw requiring only adjacency - the attacker must be on the same wireless network segment or in RF range, which lowers the effective attack surface relative to AV:N vulnerabilities. EPSS at 0.20% (10th percentile) is notably low for an 8.8-scored kernel bug, indicating that the security community's exploitation prediction models assign minimal probability of in-the-wild exploitation in the near term, consistent with the absence of a CISA KEV entry and the lack of any known public POC. The C:H/I:H/A:H triple is aggressive: while an out-of-bounds read reliably justifies C:H, achieving arbitrary write-to-code-execution in a modern hardened kernel (KASLR, SMEP, SMAP) requires additional primitives beyond the raw length bypass; the tag 'Information Disclosure' (not 'Remote Code Execution') from the EUVD entry partially corroborates a more conservative integrity/availability assessment. Real-world risk is elevated for environments with WiFi 7 (802.11be) hardware and kernels in the affected commit range that process untrusted WiFi frames - particularly access points, hotspot routers, and Linux WiFi clients in shared or public wireless environments.

An attacker within WiFi radio range of a vulnerable Linux system - or connected to the same wireless network segment - transmits a crafted IEEE 802.11 management frame containing a Reconfiguration or Priority Access Multi-Link Element with an invalid advertised common-info length. The kernel's ieee80211_mle_size_ok() accepts the frame without rejecting the malformed length, and subsequent calls to ieee80211_mle_common_size() use the attacker-controlled value to compute offsets, causing an out-of-bounds memory access in kernel context. No public proof-of-concept exists at time of analysis; successful exploitation to achieve code execution would additionally require bypassing modern kernel mitigations such as KASLR and SMEP.