CVE-2020-26147: Linux Kernel Fragment Injection Vulnerability

CVE-2020-26147 Overview

CVE-2020-26147 is a Wi-Fi protocol implementation flaw in the Linux kernel 5.8.9. The WEP, WPA, WPA2, and WPA3 implementations reassemble frame fragments even when some fragments arrive in plaintext. This flaw is part of the FragAttacks family of vulnerabilities disclosed by Mathy Vanhoef in May 2021. Attackers within radio range can abuse the bug to inject malicious packets or exfiltrate selected fragments from victim traffic. The issue affects multiple downstream products, including Debian Linux, Arista access points, and Siemens SCALANCE wireless devices.

Critical Impact
An adjacent-network attacker can inject crafted frames or exfiltrate fragmented Wi-Fi traffic when WEP, CCMP, or GCMP is in use, compromising the integrity of wireless communications.

Affected Products

Linux kernel 5.8.9 and related branches
Debian Linux 9.0 and Debian LTS distributions
Arista C-65, C-75, O-90, and W-68 access point firmware
Siemens SCALANCE W700 (IEEE 802.11n) and SCALANCE W1700 (IEEE 802.11ac) firmware

Discovery Timeline

2021-05-11 - FragAttacks research published by Mathy Vanhoef on the Openwall oss-security mailing list
2021-05-11 - CVE-2020-26147 published to NVD
2026-04-14 - Last updated in NVD database

Technical Details for CVE-2020-26147

Vulnerability Analysis

The vulnerability resides in the fragmentation handling logic of the Linux kernel mac80211 Wi-Fi stack. The IEEE 802.11 standard allows large frames to be split into fragments that the receiver reassembles before processing. Secure implementations must verify that all fragments belonging to a frame share the same security context, meaning all fragments must be encrypted under the same key or all must be plaintext.

The Linux implementation fails this check. The receiver accepts and reassembles a frame composed of a mix of encrypted and plaintext fragments. An attacker within wireless range can craft a malicious plaintext fragment and combine it with a legitimate encrypted fragment from a victim. The reassembled frame is then handed to higher layers as if it were trusted.

The practical outcome is packet injection into a protected wireless network and selective exfiltration of victim fragments. The exploit complexity is high because the attacker must observe the victim transmitting fragmented frames and time the injection correctly.

Root Cause

The root cause is missing validation that all fragments of an 802.11 frame use the same encryption state. The reassembly path in the Linux Wi-Fi stack does not enforce uniform protection across fragments, allowing mixed-encryption reassembly. The flaw is categorized under [CWE-Other] in NVD and affects WEP, CCMP, and GCMP data-confidentiality protocols.

Attack Vector

The attacker must be within radio range of the victim network, satisfying the adjacent-network attack vector. User interaction is required because the victim must transmit a fragmented frame for the attacker to manipulate. The attacker injects a forged plaintext fragment that the kernel reassembles with a captured encrypted fragment. This produces a forged frame that the network stack accepts, enabling traffic injection or leakage of selected payload bytes from the victim's fragmented traffic.

The vulnerability mechanism is described in detail at the FragAttacks Official Website and the GitHub FragAttacks Summary.

Detection Methods for CVE-2020-26147

Indicators of Compromise

Unexpected plaintext 802.11 data frames observed on a network configured for WPA2 or WPA3 encryption.
Wireless traffic captures showing fragmented frames where the More Fragments bit is set on plaintext frames interleaved with encrypted fragments.
Anomalous ARP, DNS, or ICMP traffic originating from clients that should only emit encrypted frames.

Detection Strategies

Deploy a wireless intrusion detection system (WIDS) capable of inspecting fragmentation flags and flagging mixed encrypted and plaintext fragment chains.
Monitor access point logs for clients sending unusually high volumes of fragmented frames or fragments with mismatched packet numbers.
Correlate radio-frequency anomalies with endpoint network telemetry to identify injected traffic that lacks a corresponding application-layer flow.

Monitoring Recommendations

Capture and review 802.11 frame metadata at managed access points, focusing on fragment count, fragment number, and protection flag inconsistencies.
Track kernel version and Wi-Fi driver build across Linux endpoints to identify devices still running vulnerable mac80211 code.
Audit IoT and operational technology devices, particularly Siemens SCALANCE and Arista access points, against vendor advisories for firmware status.

How to Mitigate CVE-2020-26147

Immediate Actions Required

Apply kernel updates from your Linux distribution that include the FragAttacks fragment-validation patches; Debian users should follow the Debian LTS Security Announcement.
Update Arista access point firmware according to Arista Security Advisory #12602.
Patch Siemens SCALANCE W700 and W1700 firmware per the Siemens Security Product Cert advisory SSA-913875.
Inventory all Wi-Fi clients, routers, and access points to identify devices running vulnerable kernel or firmware versions.

Patch Information

The upstream Linux kernel was patched in the mac80211 subsystem to drop frames composed of fragments with inconsistent encryption states. Vendor advisories from Debian, Arista, Cisco, and Siemens reference the corresponding fixes. Refer to the Openwall Security Mailing List announcement for the original patch coordination details and the Cisco Security Advisory for affected Cisco product remediation.

Workarounds

Enforce TLS, SSH, or IPsec on all sensitive traffic so that injected or exfiltrated 802.11 fragments cannot reveal plaintext payloads.
Disable fragmentation on access points where supported by setting the fragmentation threshold to the maximum frame size.
Restrict wireless coverage and use directional antennas to reduce the attacker's ability to reach the radio environment.
Segment IoT and OT wireless networks from corporate networks to limit blast radius if fragment injection succeeds.

bash

# Configuration example: raise fragmentation threshold on a Linux AP using hostapd
# Edit /etc/hostapd/hostapd.conf and set:
fragm_threshold=2346

# Verify current kernel version against vendor advisories
uname -r
apt list --installed 2>/dev/null | grep -E 'linux-image|wpasupplicant'