What is the CVSS score of CVE-2026-68471?

CVE-2026-68471 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-68471?

A memory corruption flaw in Linux kernel WiFi implementations allows attackers within radio range to crash or potentially compromise affected devices.. A patch is available.

How to fix or mitigate CVE-2026-68471?

Within 24 hours, inventory all Linux systems with WiFi capability (access points, servers with WiFi NICs, networked appliances) and document their current kernel versions-focus on systems running kernels from commit 0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada1 onward. Within 7 days, apply vendor-released kernel patches addressing CVE-2026-68471 from your Linux distribution provider and schedule controlled reboots during change-management windows to minimize WiFi service disruption. Within 30 days, verify complete remediation by confirming all systems run patched kernels and implement network monitoring on WiFi interfaces to detect suspicious adjacent-network activity.

Linux Kernel CVE-2026-68471

EUVD-2026-59093 HIGH

2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67

GHSA-q4hh-8fm2-f5vw

Information Disclosure Linux Red Hat Suse

8.8

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Adjacent vector confirmed by WiFi frame parsing context; PR:N because no authentication precedes frame reception; C/I/A:H retained given kernel-context memory access, though I:H assumes exploit primitives beyond the raw bounds bypass.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

6.5 MEDIUM

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 12:54 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

8.8 (HIGH)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 06:20 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 15, 2026 - 06:20 cve.org

HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

wifi: ieee80211: validate MLE common info length

ieee80211_mle_common_size() uses the first common-info octet as the common information length for all known MLE types. However, ieee80211_mle_size_ok() only validates that octet for Basic, Probe Request, and TDLS MLEs.

Reconfiguration MLEs also skipped the length octet when calculating the minimum common size, and Priority Access MLEs skipped validation of the advertised common information length.

Account for the Reconfiguration common-info length octet and validate the advertised common information length for all known MLE types. Keep unknown-type handling unchanged.

[remove now misleading comment]

AnalysisAI

Insufficient Multi-Link Element (MLE) common info length validation in the Linux kernel's IEEE 802.11 WiFi stack exposes adjacent-network attackers to high-impact memory corruption. Kernels from commit 0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada1 onward failed to validate the advertised common-info length field for Reconfiguration and Priority Access MLE types - and also omitted the length octet when computing the minimum common size for Reconfiguration MLEs - meaning a malformed MLE frame crafted by a nearby attacker can trigger out-of-bounds access. The CVSS score of 8.8 (AV:A) and EPSS of 0.20% (10th percentile) together indicate high potential impact but no public exploit activity at time of analysis; no public exploit and no CISA KEV listing have been identified.

Technical ContextAI

IEEE 802.11be (WiFi 7) introduced Multi-Link Elements (MLEs) to allow multi-link operation across bands. The kernel's ieee80211_mle_size_ok() validator checks the first common-info octet as an advertised length, but prior to this fix that check only covered Basic, Probe Request, and TDLS MLE types. Reconfiguration MLEs additionally skipped the length octet when computing the minimum common size, creating two distinct gaps: (1) the advertised length for Reconfiguration MLEs was not validated against actual frame length, and (2) Priority Access MLEs had no common-info length validation at all. The function ieee80211_mle_common_size() subsequently uses the unvalidated advertised length to derive field offsets, making it possible for a crafted frame to cause reads or writes beyond legitimate frame boundaries. CWE is listed as N/A by NVD, but the root cause maps to improper input validation (CWE-20) and potentially out-of-bounds read/write (CWE-125/787). Affected CPE is cpe:2.3:o:linux:linux_kernel with commit-range constraints rather than a clean version boundary, starting from commit 0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada1.

RemediationAI

The primary fix is to upgrade the Linux kernel to a patched stable release: 6.18.40 for the 6.x branch, 7.1.5 for the 7.1 branch, or 7.2-rc4 or later for mainline, as documented in the respective upstream commits at https://git.kernel.org/stable/c/90576bd6921a91eb038bffbb4b9467c2dc26aa1d, https://git.kernel.org/stable/c/2b1589fd9a076727a73bfb39e96622a76415ad32, and https://git.kernel.org/stable/c/293baeae9b2434a3e432629d7720b5603db2d77e. Distributions shipping backported kernels (Debian, Ubuntu, RHEL, SUSE) should be monitored for their own stable updates. As a compensating control where patching is not immediately possible, administrators can unload or blacklist the ieee80211 and mac80211 kernel modules ('modprobe -r mac80211') on systems where WiFi is not operationally required - note this disables all WiFi functionality on the host. On managed WiFi deployments, restricting association to known, trusted clients via WPA3-Enterprise with strong EAP reduces the attacker's ability to inject crafted MLE frames, but does not eliminate the vulnerability since an attacker with a valid credential or a deauth-then-reconnect attack could still transmit malformed frames.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-68471 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-68471

Severity by source

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code