wpa_supplicant CVE-2026-78807

Exploitation requires a local low-privileged account on the target device running wpa_supplicant prior to v2.12. The vulnerable code path is specific to driver-based PMKSA cache selection - this path is triggered only when the wireless driver implements and exposes its own PMKSA cache (as opposed to wpa_supplicant managing the cache internally). Not all Wi-Fi drivers support driver-offloaded PMKSA caching; exploitation is limited to devices where this driver capability is active and in use. A prior PMKSA entry for a different network or AKMP type must exist in the driver's cache for the mismatch to be exploitable. Remote exploitation is not possible; no network-level access or user interaction is required beyond the local session. Exploitation is not automatable per SSVC assessment.

The CVSS 3.1 score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) accurately reflects the local-only attack surface. The local attack vector is the principal risk limiter - an attacker must already have a low-privileged foothold on the target device and interact with the Wi-Fi subsystem. SSVC signals Exploitation:none and Automatable:no, which aligns with the absence of public exploit code and the inherent complexity of manipulating the driver-level PMKSA cache. However, SSVC Technical Impact is rated 'total,' reflecting that successful exploitation undermines the integrity of Wi-Fi authentication entirely. The real-world risk is primarily relevant in multi-user Linux systems or IoT/embedded platforms where unprivileged users can influence wireless configuration, or in scenarios where an attacker has already achieved local code execution (e.g., via a prior vulnerability) and seeks to laterally move to a different network segment. The absence of a remote attack vector significantly reduces exposure compared to network-adjacent Wi-Fi vulnerabilities. No EPSS data was provided in the input; exploitation probability is inferred as low given no active exploitation evidence.

An attacker with a low-privileged shell on a Linux laptop or IoT device connected to a corporate Wi-Fi network engineers a situation where the driver's PMKSA cache contains an entry from a previous connection to a less-trusted network using a different AKMP. By triggering a reconnection event - for example, by momentarily forcing a disconnect - the attacker causes wpa_supplicant to select the mismatched cached PMKSA entry, bypassing the expected re-authentication against the corporate RADIUS server and instead using cached credentials from the weaker network context to gain access. No public proof-of-concept is available at time of analysis.