What is the CVSS score of EUVD-2026-59619?

EUVD-2026-59619 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Linux Kernel are affected by EUVD-2026-59619?

A kernel memory corruption vulnerability in Linux kernel's ath12k WiFi 7 driver (CVE-2026-74554, CVSS 8.8) can crash systems or enable unauthorized access on networked devices.. A patch is available.

How to fix or mitigate EUVD-2026-59619?

Within 24 hours, inventory all systems running the ath12k WiFi 7 driver and assess exposure scope. Within 7 days, apply the vendor-released patch to all affected systems, prioritizing production WiFi 7 infrastructure and critical endpoints. Within 30 days, complete patch deployment and verify successful remediation across all environments.

Linux Kernel EUVD-2026-59619

| CVE-2026-74554 HIGH

2026-08-15 Linux

GHSA-m2x9-5x38-cjm5

Buffer Overflow Linux Red Hat Suse

8.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Adjacent vector confirmed by WiFi proximity requirement; PR:N because no credentials are needed on the WiFi segment; full C/I/A from kernel memory corruption scope.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

6.4 MEDIUM

AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Red Hat

7.0 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 12:23 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

8.8 (HIGH)

Patch available

Aug 15, 2026 - 13:04 EUVD

CVE Published

Aug 15, 2026 - 12:28 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 15, 2026 - 12:28 cve.org

HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: fix out-of-bounds clear_bit in ath12k_mac_dp_peer_cleanup()

ath12k_mac_dp_peer_cleanup() clears the ML peer ID slot on the free_ml_peer_id_map bitmap by indexing it with dp_peer->peer_id. That is wrong: dp_peer->peer_id for an MLO peer always carries the ATH12K_PEER_ML_ID_VALID bit (BIT(13)), so clear_bit() is invoked with index >= 0x2000, which is far outside the bitmap of ATH12K_MAX_MLO_PEERS (256) bits and corrupts memory adjacent to ah->free_ml_peer_id_map. The intended bitmap entry also never gets cleared, so subsequent ath12k_peer_ml_alloc() calls eventually run out of IDs.

The ID without the VALID bit is what ath12k_peer_ml_alloc() returned and is stored in ahsta->ml_peer_id. Use that instead.

While there, also reset ahsta->ml_peer_id to ATH12K_MLO_PEER_ID_INVALID so the bitmap and ahsta->ml_peer_id stay in sync.

Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3

AnalysisAI

Out-of-bounds memory corruption in the Linux kernel's ath12k WiFi 7 driver corrupts kernel memory adjacent to the ML peer ID bitmap during MLO peer cleanup. The ath12k_mac_dp_peer_cleanup() function incorrectly indexes a 256-bit bitmap with dp_peer->peer_id, which always carries the ATH12K_PEER_ML_ID_VALID flag (BIT(13), value 8192+), causing clear_bit() to write far outside the valid bitmap range. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Join adjacent WiFi segment

Delivery

Initiate MLO peer association with target device

Exploit

Trigger ath12k peer cleanup path

Execution

Out-of-bounds clear_bit corrupts kernel memory beyond bitmap

Impact

Leverage memory corruption for kernel code execution or exhaust ML peer IDs for denial of service

Access

Join adjacent WiFi segment

Delivery

Initiate MLO peer association with target device

Exploit

Trigger ath12k peer cleanup path

Execution

Out-of-bounds clear_bit corrupts kernel memory beyond bitmap

Impact

Leverage memory corruption for kernel code execution or exhaust ML peer IDs for denial of service

Vulnerability AssessmentAI

Exploitation	Exploitation requires the attacker to be physically within WiFi radio range or logically on the same Layer 2 WiFi segment as the target - internet-based remote exploitation is not possible given the Adjacent network vector. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 8.8 rating with an Adjacent network vector (AV:A) significantly limits the realistic attacker population: exploitation requires physical or logical WiFi proximity, not open internet reachability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker within WiFi radio range of a device running a vulnerable ath12k-equipped Linux system initiates MLO peer association and then triggers repeated peer teardown cycles. Each cleanup call writes an out-of-bounds value - derived from the flagged peer ID 8192 or higher - into kernel memory beyond the 256-bit bitmap, progressively corrupting adjacent kernel structures. …
Remediation	Upgrade to Linux 7.1.8 or 7.2-rc6 (or any later release), which incorporate the upstream fixes at commits 47abd2ca281531deee38a3b3770d885e270e9fc9 and 234b5cb81e6fcc1e3b31b13deff66130be55f36e (https://git.kernel.org/stable/c/47abd2ca281531deee38a3b3770d885e270e9fc9 and https://git.kernel.org/stable/c/234b5cb81e6fcc1e3b31b13deff66130be55f36e). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all systems running the ath12k WiFi 7 driver and assess exposure scope. …

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

EUVD-2026-59619 vulnerability details – vuln.today

Back

Linux Kernel EUVD-2026-59619

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code