CVE-2026-68471

wifi: ieee80211: validate MLE common info length

HIGH
8.8
CVSS Score
Published: August 15, 2026 at 05:51 AM UTC
Updated: October 30, 2026 at 01:19 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
HIGH8.8
Exploit prediction
EPSS 0.3%

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: ieee80211: validate MLE common info length ieee80211_mle_common_size() uses the first common-info octet as the common information length for all known MLE types. However, ieee80211_mle_size_ok() only validates that octet for Basic, Probe Request, and TDLS MLEs. Reconfiguration MLEs also skipped the length octet when calculating the minimum common size, and Priority Access MLEs skipped validation of the advertised common information length. Account for the Reconfiguration common-info length octet and validate the advertised common information length for all known MLE types. Keep unknown-type handling unchanged. [remove now misleading comment]

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

0f48b8b88aa9ed7b65d7cb55dbc57ec914ddada16.0
Vendor states this is fixed in 293baeae9b2434a3e432629d7720b5603db2d77e (fixed)
Vendor states this is fixed in 2b1589fd9a076727a73bfb39e96622a76415ad32 (fixed)
Vendor states this is fixed in 90576bd6921a91eb038bffbb4b9467c2dc26aa1d (fixed)
Vendor states this is fixed in 6.0 (unaffected)
Vendor states this is fixed in 6.12.114 (unaffected)
Vendor states this is fixed in 6.18.40 (unaffected)
Vendor states this is fixed in 6.6.160 (unaffected)
Vendor states this is fixed in 7.1.5 (unaffected)
Vendor states this is fixed in 7.2 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

CVSS

8.8HIGHLinux
Vector?

Quick Info

StatusRECEIVED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card