{"id":"CVE-2026-68402","title":"wifi: cfg80211: bound element ID read when checking non-inheritance","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: bound element ID read when checking non-inheritance\n\ncfg80211_is_element_inherited() reads the first data octet of the\ncandidate element (id = elem->dat…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 < 521dd5fe6d12b0d3c275f919738dc3a07117f4a5","Linux >= f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 < 24154c172246ae3f0e69bb17c9111095685ceedc","Linux >= f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 < 2d31ebb26a14f103c9cdc5287fb20cb2d4bde901","Linux >= f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 < 20c308d9a57722801961f816395bf825f7bde6bc","Linux >= f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 < 84bd907361c56fbd5523eceb2682cb39da059bd5","Linux >= f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 < 11ac7a5e75f5132f1778e0c60981d30dc29fb869","Linux >= f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 < ddf2773bcc8e49a43c561f22ec1e7924215d7947","Linux >= f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 < cb8afea4655ff004fa7feee825d5c79783525383","Linux 5.2"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-16T15:48:17.274727Z"},"published":"2026-08-10","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:53:12.030Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68402","references":[{"url":"https://git.kernel.org/stable/c/521dd5fe6d12b0d3c275f919738dc3a07117f4a5"},{"url":"https://git.kernel.org/stable/c/24154c172246ae3f0e69bb17c9111095685ceedc"},{"url":"https://git.kernel.org/stable/c/2d31ebb26a14f103c9cdc5287fb20cb2d4bde901"},{"url":"https://git.kernel.org/stable/c/20c308d9a57722801961f816395bf825f7bde6bc"},{"url":"https://git.kernel.org/stable/c/84bd907361c56fbd5523eceb2682cb39da059bd5"},{"url":"https://git.kernel.org/stable/c/11ac7a5e75f5132f1778e0c60981d30dc29fb869"},{"url":"https://git.kernel.org/stable/c/ddf2773bcc8e49a43c561f22ec1e7924215d7947"},{"url":"https://git.kernel.org/stable/c/cb8afea4655ff004fa7feee825d5c79783525383"}],"tags":["cve.org"],"epss":0.00265,"epssPercentile":0.17184,"ingestedAt":"2026-10-16T17:24:46.863Z","slug":"CVE-2026-68402","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: bound element ID read when checking non-inheritance\n\ncfg80211_is_element_inherited() reads the first data octet of the\ncandidate element (id = elem->data[0]) to look it up in an extension\nnon-inheritance list. It does so after testing elem->id, but without\nverifying that the element actually has a data octet. A zero-length\nextension element (WLAN_EID_EXTENSION with length 0) therefore makes it\nread one octet past the end of the element.\n\n_ieee802_11_parse_elems_full() runs this check for every element of a\nframe once a non-inheritance context exists -- e.g. while parsing a\nper-STA profile of a Multi-Link element in a (re)association response,\nor a non-transmitted BSS profile -- so a crafted frame from an AP can\ntrigger a one-octet slab-out-of-bounds read during element parsing:\n\n  BUG: KASAN: slab-out-of-bounds in cfg80211_is_element_inherited\n  Read of size 1 ... in net/wireless/scan.c\n\nReturn early (treat the element as inherited) when an extension element\ncarries no data, mirroring the existing handling of empty ID lists.\n\nThe bug was found by fuzzing ieee802_11_parse_elems_full() under KASAN.\n\n## Affected\n\n- `Linux >= f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 < 521dd5fe6d12b0d3c275f919738dc3a07117f4a5`\n- `Linux >= f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 < 24154c172246ae3f0e69bb17c9111095685ceedc`\n- `Linux >= f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 < 2d31ebb26a14f103c9cdc5287fb20cb2d4bde901`\n- `Linux >= f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 < 20c308d9a57722801961f816395bf825f7bde6bc`\n- `Linux >= f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 < 84bd907361c56fbd5523eceb2682cb39da059bd5`\n- `Linux >= f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 < 11ac7a5e75f5132f1778e0c60981d30dc29fb869`\n- `Linux >= f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 < ddf2773bcc8e49a43c561f22ec1e7924215d7947`\n- `Linux >= f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 < cb8afea4655ff004fa7feee825d5c79783525383`\n- `Linux 5.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}