---
id: CVE-2026-64117
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb

  ieee80211_invoke_fast_rx() reads RX status through
  IEEE80211_SKB_RXCB(skb), which aliases the same skb-…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb

  ieee80211_invoke_fast_rx() reads RX status through
  IEEE80211_SKB_RXCB(skb), which aliases the same skb-…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-416
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 6.4, < 7.0.11'
  - linux_kernel = 7.1
patched:
  - linux_kernel 7.0.11
published: '2026-07-19'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T11:17:39.120'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-64117'
references:
  - url: 'https://git.kernel.org/stable/c/2fb64f94f9afb774f2fa0c7835727d7a67f89f07'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a2650f8461cd8ba287fee2992b36abe733c2bd5e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d71c841be5d9e586ee7f36c0dc8ed4db0d9a1349'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00234
epssPercentile: 0.1329
ingestedAt: '2026-10-15T11:00:41.695Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb

ieee80211_invoke_fast_rx() reads RX status through
IEEE80211_SKB_RXCB(skb), which aliases the same skb->cb storage
that ieee80211_rx_mesh_data() reuses as IEEE80211_TX_INFO.  In the
unicast forward path, mesh_data does:

	info = IEEE80211_SKB_CB(fwd_skb);
	memset(info, 0, sizeof(*info));

on the same skb the caller still names via rx->skb, then either
queues the skb for TX (success) or kfree_skb()'s it (no-route)
before returning RX_QUEUED.  The caller's RX_QUEUED arm then
calls sta_stats_encode_rate(status) on memory that is either
zeroed (success path) or freed (no-route path).  The latter is
KASAN slab-use-after-free in ieee80211_prepare_and_rx_handle.

Fix by encoding the rate from status before invoking
ieee80211_rx_mesh_data(), so the RX_QUEUED arm consumes a value
captured while status was still backed by valid memory.

## Affected

- `linux_kernel >= 6.4, < 7.0.11`
- `linux_kernel = 7.1`

## Remediation

Upgrade past the affected range:

- `linux_kernel 7.0.11`