Skip to main content

Linux Kernel EUVDEUVD-2026-45603

| CVE-2026-64030 HIGH
2026-07-19 Linux GHSA-2j8j-jv7c-wm9j
Denial Of Service Linux
8.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.8 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.5 MEDIUM

Adjacent rogue-AP attack (AV:A), no prior request needed once EPCS enabled (AC:L/PR:N/UI:N); impact is an OOB-read kernel crash only, so C:N/I:N/A:H, not the vendor's C:H/I:H.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.0 HIGH
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 16:57 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
8.8 (HIGH)
Patch available
Jul 19, 2026 - 17:03 EUVD
CVE Published
Jul 19, 2026 - 15:39 cve.org
HIGH 8.8
CVE Published
Jul 19, 2026 - 15:39 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs

IEEE80211_MLE_STA_EPCS_CONTROL_LINK_ID is 0x000f, so link_id extracted from a PRIO_ACCESS ML element PER_STA_PROFILE subelement can be 0..15. sdata->link[] has IEEE80211_MLD_MAX_NUM_LINKS (15) entries (indices 0..14), making index 15 out-of-bounds.

A connected WiFi 7 AP can trigger this by sending an EPCS Enable Response action frame with a PER_STA_PROFILE subelement where link_id = 15. The unsolicited-notification path (dialog_token = 0) is reachable any time EPCS is already enabled, without any prior client request.

sdata->link[15] reads into the first word of sdata->activate_links_work (a wiphy_work whose embedded list_head is non-NULL after INIT_LIST_HEAD), so the NULL check on the result does not catch the invalid access. The garbage pointer is then passed to ieee80211_sta_wmm_params(), which dereferences link->sdata and crashes the kernel.

The same class of bug was fixed for ieee80211_ml_reconfiguration() by commit 162d331d833d ("wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration").

AnalysisAI

Remote kernel crash in the Linux kernel's mac80211 WiFi stack affects WiFi 7 (802.11be) clients: the ieee80211_ml_epcs() handler fails to bounds-check the 4-bit link_id (0-15) extracted from an EPCS PER_STA_PROFILE subelement, but sdata->link[] holds only 15 entries (indices 0-14), so link_id=15 reads out of bounds. A connected access point can send an EPCS Enable Response action frame with link_id=15 to read a garbage pointer that bypasses the NULL check and is dereferenced in ieee80211_sta_wmm_params(), crashing the kernel. There is no public exploit identified at time of analysis, EPSS is low (0.17%), and this is a denial-of-service (kernel panic) rather than the code-execution/data-disclosure implied by the vendor CVSS.

Technical ContextAI

The flaw lives in mac80211, the Linux kernel's software MAC layer for SoftMAC WiFi drivers, specifically in the Multi-Link Operation (MLO) EPCS (Emergency Preparedness Communications Service / Priority Access) handling introduced with WiFi 7 / IEEE 802.11be. The constant IEEE80211_MLE_STA_EPCS_CONTROL_LINK_ID is 0x000f, so link_id parsed from a PRIO_ACCESS Multi-Link element PER_STA_PROFILE subelement spans 0..15, while sdata->link[] is sized to IEEE80211_MLD_MAX_NUM_LINKS (15), covering only indices 0..14. This is a classic off-by-one out-of-bounds array read (CWE-125 class; NVD lists CWE as N/A). What makes it dangerous rather than benign is memory layout: link[15] overlaps the first word of sdata->activate_links_work, a wiphy_work whose embedded list_head is non-NULL after INIT_LIST_HEAD, so the resulting garbage pointer survives the subsequent NULL check and is dereferenced (link->sdata) inside ieee80211_sta_wmm_params(). The same bug class was previously fixed in ieee80211_ml_reconfiguration() by commit 162d331d833d.

RemediationAI

Vendor-released patch: update to a fixed Linux kernel - 6.18.34, 7.0.11, or 7.1 (or your distribution's backport carrying stable commit 2d8379834800, 863f1f02a3bd, or f718506edd2d from git.kernel.org/stable). Because the fix is a one-line bounds check on link_id it backports cleanly, so prefer the distro kernel update. If you cannot patch immediately, compensating controls are limited but concrete: on affected WiFi 7 stations, disable EPCS / Priority Access if the driver or wpa_supplicant configuration exposes it, or restrict clients to trusted, authenticated networks (WPA3-Enterprise with server validation) so an attacker cannot present a rogue AP that a client will associate with - the trade-off is loss of EPCS emergency-access functionality and reduced roaming flexibility. As a broader control, avoid connecting WiFi 7 clients to untrusted/open networks until patched, since the trigger requires association with the attacker-controlled AP. Advisory and patch references: https://git.kernel.org/stable/c/2d8379834800c30602f24c71ab7c40f5fe84d200 and https://nvd.nist.gov/vuln/detail/CVE-2026-64030.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-45603 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy