Skip to main content

Linux Kernel EUVDEUVD-2026-53268

| CVE-2026-64574 HIGH
2026-08-05 Linux GHSA-5g36-vffc-3jvc
Information Disclosure Linux Canonical
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local-only vector with low-privilege WiFi interface access required; MLO hardware prerequisite is an environmental constraint, not an AC factor, as no race is needed once trigger conditions are met.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.7 MEDIUM
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 08, 2026 - 15:29 vuln.today
CVSS changed
Aug 08, 2026 - 15:22 NVD
7.8 (HIGH)
Patch available
Aug 05, 2026 - 09:01 EUVD
CVE Published
Aug 05, 2026 - 08:08 cve.org
HIGH 7.8
CVE Published
Aug 05, 2026 - 08:08 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: tear down new links on vif update error path

When ieee80211_vif_update_links() adds new links it allocates a link container for each and calls ieee80211_link_init() (which registers the per-link debugfs files with file->private_data pointing into the container) and ieee80211_link_setup(). If the subsequent drv_change_vif_links() fails, the error path restores the old pointers and jumps to 'free', which frees the new containers but never removes their debugfs entries or stops the links. The debugfs files survive with file->private_data dangling at the freed container, so a later open()+read() (e.g. link-1/txpower) dereferences freed memory in ieee80211_if_read_link(), a use-after-free.

The removal path already dismantles links correctly via ieee80211_tear_down_links(), which removes each link's keys and debugfs entries and calls ieee80211_link_stop(); the add path on the error branch does not. Commit be1ba9ed221f ("wifi: mac80211: avoid weird state in error path") hardened this same error path for the link-removal case (new_links == 0) but left the newly-added links' teardown unaddressed.

drv_change_vif_links() can fail at runtime on MLO drivers (internal allocation / queue / firmware command failures).

Remove the new links' debugfs entries and stop them before freeing.

BUG: KASAN: slab-use-after-free in ieee80211_if_read_link (net/mac80211/debugfs_netdev.c:127) Read of size 8 at addr ffff888011290000 by task exploit/145 Call Trace: ... ieee80211_if_read_link (net/mac80211/debugfs_netdev.c:127) short_proxy_read (fs/debugfs/file.c:373) vfs_read (fs/read_write.c:572) ksys_read (fs/read_write.c:716) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) ... Oops: general protection fault, probably for non-canonical address 0xdffffc000000000a RIP: 0010:ieee80211_if_read_link (net/mac80211/debugfs_netdev.c:127) Kernel panic - not syncing: Fatal exception

AnalysisAI

Use-after-free in the Linux kernel mac80211 MLO (Multi-Link Operation) subsystem allows a local attacker with low privileges to corrupt kernel memory by reading stale debugfs entries after a failed ieee80211_vif_update_links() operation. Systems running kernel 6.4 or later with WiFi 7 (IEEE 802.11be) MLO-capable hardware are within the affected code path; patched releases are available across all active stable branches. No public exploit or CISA KEV listing exists and EPSS is 0.16%, but CVSS impact metrics of C:H/I:H/A:H indicate full kernel compromise potential if the vulnerability is successfully triggered, as confirmed by a KASAN slab-use-after-free trace referencing a task named 'exploit/145'.

Technical ContextAI

The mac80211 subsystem (net/mac80211/) provides the IEEE 802.11 WiFi software MAC layer in the Linux kernel. Multi-Link Operation (MLO), introduced in Linux 6.4 for WiFi 7 (IEEE 802.11be), allows a single virtual interface to operate across multiple physical radio links simultaneously. The function ieee80211_vif_update_links() manages addition and removal of these per-link containers. When new links are added, ieee80211_link_init() registers per-link debugfs entries with file->private_data pointing into the newly allocated container, followed by ieee80211_link_setup(). If the subsequent drv_change_vif_links() driver call fails - possible on MLO drivers due to internal allocation, queue, or firmware command failures - the error path restores old pointers and frees the new containers, but does not call ieee80211_tear_down_links(), which would have removed debugfs entries and called ieee80211_link_stop(). The dangling file->private_data pointer survives in the VFS, and any subsequent open()+read() on those entries (e.g., link-1/txpower) triggers ieee80211_if_read_link() at debugfs_netdev.c:127 on freed heap memory. KASAN identifies this as a slab-use-after-free (CWE-416), which can escalate to a general protection fault and kernel panic. Commit be1ba9ed221f had previously hardened the link-removal error path but left the link-addition error path unaddressed. CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade to a patched Linux kernel stable release: 6.6.148, 6.12.101, 6.18.42, or 7.1.6, all of which contain the fix via commits published at https://git.kernel.org/stable/c/329589417214d3b7221432e5b266ed2bba7ff674 and associated stable-branch refs. Distribution packages from Canonical (Ubuntu is tagged in the advisory), Debian, Red Hat, SUSE, and others should be monitored and applied once released. If an immediate kernel upgrade is not feasible, a targeted compensating control is to restrict CAP_NET_ADMIN to root-only processes, preventing unprivileged users from configuring WiFi interfaces and triggering the affected code path - note this disables user-space WiFi management tools (wpa_supplicant, NetworkManager in user context) and may require service reconfiguration. Additionally, restricting debugfs visibility (e.g., mounting debugfs with mode=700 or applying an LSM policy that denies read access to /sys/kernel/debug/ieee80211/ for non-root users) removes the read vector for the dangling pointer, though this may impact kernel observability and tracing tooling. If MLO functionality is not operationally required, disabling or denylisting MLO-capable WiFi drivers eliminates the affected code path entirely at the cost of WiFi 7 multi-link performance features.

More in Canonical

View all
CVE-2011-3544 CRITICAL POC
9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
CVE-2019-11043 CRITICAL POC
9.8 Oct 28

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it

CVE-2014-6271 CRITICAL POC
9.8 Sep 24

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
CVE-2013-0422 CRITICAL POC
9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
CVE-2016-3714 HIGH POC
8.4 May 05

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
CVE-2017-12617 HIGH POC
8.1 Oct 04

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
CVE-2016-8735 CRITICAL POC
9.8 Apr 06

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
CVE-2014-7169 CRITICAL POC
9.8 Sep 25

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
CVE-2014-0160 HIGH POC
7.5 Apr 07

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
CVE-2016-5195 HIGH POC
7.0 Nov 10

Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
CVE-2013-2423 LOW POC
3.7 Apr 17

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and
CVE-2023-4911 HIGH POC
7.8 Oct 03

Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected

Share

EUVD-2026-53268 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy