What is the CVSS score of CVE-2026-68472?

CVE-2026-68472 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-68472?

CVE-2026-68472 is a kernel memory disclosure and denial-of-service vulnerability in Linux WiFi subsystems affecting any organization with wireless infrastructure or WiFi-connected Linux servers.. A patch is available.

How to fix or mitigate CVE-2026-68472?

Within 24 hours: Inventory all Linux systems with WiFi capabilities (check with iwconfig or rfkill) and confirm running kernel versions via uname -r, prioritizing production wireless infrastructure and WiFi-connected servers. Within 7 days: Obtain and apply the Linux kernel security patch from your distribution (check your vendor's security advisory for the specific patched version); test patches in a non-production WiFi environment first, then execute rolling updates to production systems with minimal downtime. Within 30 days: Verify all Linux systems have been patched to the latest kernel version and document the update, enable WiFi intrusion detection monitoring on critical networks, and establish a quarterly Linux kernel patch cadence to prevent similar vulnerabilities.

Linux Kernel CVE-2026-68472

EUVD-2026-59094 HIGH

2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67

GHSA-chr6-4qp3-f3h9

Information Disclosure Linux Red Hat Suse

8.1

CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY

8.1 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

vuln.today AI

8.1 HIGH

Adjacent vector because radio proximity is required; no authentication or interaction needed; C:H from potential heap read, A:H from kernel crash risk, I:N as no write path exists.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

6.5 MEDIUM

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 12:54 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

8.1 (HIGH)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 06:20 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 15, 2026 - 06:20 cve.org

HIGH 8.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: validate EHT MLE before MLD ID read

cfg80211_gen_new_ie() copies ML probe response elements from the parent frame when the parent EHT multi-link element has an MLD ID matching the nontransmitted BSSID index.

The code only checked that the extension element had more than one byte before calling ieee80211_mle_get_mld_id(). That helper assumes a BASIC MLE with enough common info and documents that callers must first use ieee80211_mle_type_ok().

Attack chain: malicious AP sends a short EHT MLE in an MBSSID beacon. cfg80211_inform_bss_frame_data() stores the copied IE buffer. cfg80211_parse_mbssid_data() builds the nontransmitted BSS IE. cfg80211_gen_new_ie() sees the EHT MLE in the parent frame. ieee80211_mle_get_mld_id() then reads past the IE boundary.

Validate the MLE type and size before reading the MLD ID. This matches the contract required by the MLE helper and rejects the short element before any internal MLE fields are accessed.

AnalysisAI

Out-of-bounds read in the Linux kernel cfg80211 WiFi subsystem allows an adjacent-network unauthenticated attacker to disclose kernel memory or crash the system by sending a crafted EHT Multi-Link Element inside an MBSSID beacon frame. Affected kernels fail to call ieee80211_mle_type_ok() before passing the element to ieee80211_mle_get_mld_id(), violating the helper's documented contract and allowing reads past the IE boundary. No public exploit exists and EPSS is 0.20% (10th percentile), but the attack requires only radio proximity to a device with Wi-Fi scanning active - no authentication and no user interaction needed.

Technical ContextAI

The vulnerability is in cfg80211_gen_new_ie() within the Linux kernel's cfg80211 wireless configuration framework, which handles 802.11be (Wi-Fi 7) EHT (Extremely High Throughput) Multi-Link Element (MLE) parsing for Multiple BSSID (MBSSID) beacon and probe-response frames. When copying ML probe response elements from a parent frame, the code verified only that the extension IE exceeded one byte before invoking ieee80211_mle_get_mld_id(). That helper is documented to require callers to first validate via ieee80211_mle_type_ok(), which checks both the MLE type field and that sufficient common-info bytes are present for a BASIC MLE. Omitting this check allows a maliciously crafted, undersized EHT MLE to cause the helper to read past the IE buffer boundary. The root cause is improper input validation of a Wi-Fi management frame field - functionally equivalent to CWE-125 (Out-of-Bounds Read). Affected kernel range begins at commit 61dcfa8c2a8f6c53ce77b2c832b82990754b2aa9 and is fixed by three separate stable-branch commits.

RemediationAI

Upgrade to a patched kernel release: Linux 7.1.5, 6.18.40, or 7.2-rc4 (or later). The upstream fix commits are available at https://git.kernel.org/stable/c/3b0505e43da8fb5b2a7994c3c3604e5a74692154, https://git.kernel.org/stable/c/584657c5fc58d7a840623a2fa06331c9661dd0f1, and https://git.kernel.org/stable/c/74e27cd1d98b546fdb276008a83708d062339661 - distribution maintainers should backport the appropriate commit for their stable branch. Until patching is feasible, disabling Wi-Fi interfaces entirely on systems that do not require wireless connectivity (e.g., 'ip link set wlan0 down' or blacklisting the cfg80211 module) eliminates the adjacent-network attack surface with no security trade-off, though it removes wireless networking capability. For systems that must retain Wi-Fi, restricting operation to trusted managed access points and deploying wireless intrusion detection to alert on anomalous MBSSID beacon traffic can reduce risk. Passive scanning cannot be disabled at the application layer without kernel-level changes, so interface-level suppression is the only reliable compensating control.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-68472 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-68472

Severity by source

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code