---
id: CVE-2026-68402
title: 'wifi: cfg80211: bound element ID read when checking non-inheritance'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: cfg80211: bound element ID read when checking non-inheritance

  cfg80211_is_element_inherited() reads the first data octet of the
  candidate element (id = elem->dat…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 <
    521dd5fe6d12b0d3c275f919738dc3a07117f4a5
  - >-
    Linux >= f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 <
    24154c172246ae3f0e69bb17c9111095685ceedc
  - >-
    Linux >= f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 <
    2d31ebb26a14f103c9cdc5287fb20cb2d4bde901
  - >-
    Linux >= f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 <
    20c308d9a57722801961f816395bf825f7bde6bc
  - >-
    Linux >= f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 <
    84bd907361c56fbd5523eceb2682cb39da059bd5
  - >-
    Linux >= f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 <
    11ac7a5e75f5132f1778e0c60981d30dc29fb869
  - >-
    Linux >= f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 <
    ddf2773bcc8e49a43c561f22ec1e7924215d7947
  - >-
    Linux >= f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 <
    cb8afea4655ff004fa7feee825d5c79783525383
  - Linux 5.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T15:48:17.274727Z'
published: '2026-08-10'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:53:12.030Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68402'
references:
  - url: 'https://git.kernel.org/stable/c/521dd5fe6d12b0d3c275f919738dc3a07117f4a5'
  - url: 'https://git.kernel.org/stable/c/24154c172246ae3f0e69bb17c9111095685ceedc'
  - url: 'https://git.kernel.org/stable/c/2d31ebb26a14f103c9cdc5287fb20cb2d4bde901'
  - url: 'https://git.kernel.org/stable/c/20c308d9a57722801961f816395bf825f7bde6bc'
  - url: 'https://git.kernel.org/stable/c/84bd907361c56fbd5523eceb2682cb39da059bd5'
  - url: 'https://git.kernel.org/stable/c/11ac7a5e75f5132f1778e0c60981d30dc29fb869'
  - url: 'https://git.kernel.org/stable/c/ddf2773bcc8e49a43c561f22ec1e7924215d7947'
  - url: 'https://git.kernel.org/stable/c/cb8afea4655ff004fa7feee825d5c79783525383'
tags:
  - cve.org
epss: 0.00265
epssPercentile: 0.17184
ingestedAt: '2026-10-16T17:24:46.863Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: bound element ID read when checking non-inheritance

cfg80211_is_element_inherited() reads the first data octet of the
candidate element (id = elem->data[0]) to look it up in an extension
non-inheritance list. It does so after testing elem->id, but without
verifying that the element actually has a data octet. A zero-length
extension element (WLAN_EID_EXTENSION with length 0) therefore makes it
read one octet past the end of the element.

_ieee802_11_parse_elems_full() runs this check for every element of a
frame once a non-inheritance context exists -- e.g. while parsing a
per-STA profile of a Multi-Link element in a (re)association response,
or a non-transmitted BSS profile -- so a crafted frame from an AP can
trigger a one-octet slab-out-of-bounds read during element parsing:

  BUG: KASAN: slab-out-of-bounds in cfg80211_is_element_inherited
  Read of size 1 ... in net/wireless/scan.c

Return early (treat the element as inherited) when an extension element
carries no data, mirroring the existing handling of empty ID lists.

The bug was found by fuzzing ieee802_11_parse_elems_full() under KASAN.

## Affected

- `Linux >= f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 < 521dd5fe6d12b0d3c275f919738dc3a07117f4a5`
- `Linux >= f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 < 24154c172246ae3f0e69bb17c9111095685ceedc`
- `Linux >= f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 < 2d31ebb26a14f103c9cdc5287fb20cb2d4bde901`
- `Linux >= f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 < 20c308d9a57722801961f816395bf825f7bde6bc`
- `Linux >= f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 < 84bd907361c56fbd5523eceb2682cb39da059bd5`
- `Linux >= f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 < 11ac7a5e75f5132f1778e0c60981d30dc29fb869`
- `Linux >= f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 < ddf2773bcc8e49a43c561f22ec1e7924215d7947`
- `Linux >= f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 < cb8afea4655ff004fa7feee825d5c79783525383`
- `Linux 5.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.