CVE-2026-64030: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64030 Overview

CVE-2026-64030 is an out-of-bounds read vulnerability in the Linux kernel's mac80211 subsystem, specifically within the ieee80211_ml_epcs() function that handles WiFi 7 Multi-Link Operation (MLO) Emergency Preemption Communication Service (EPCS) frames. The flaw stems from missing bounds validation on a link_id value extracted from a PER_STA_PROFILE subelement of a PRIO_ACCESS Multi-Link (ML) element. A connected WiFi 7 access point can send a crafted EPCS Enable Response action frame with link_id = 15, causing the kernel to index past the 15-entry sdata->link[] array and dereference a corrupt pointer, crashing the kernel.

Critical Impact
A malicious or compromised WiFi 7 AP on the adjacent network can trigger a kernel crash on connected Linux clients without any prior client-side interaction once EPCS is enabled.

Affected Products

Linux kernel builds containing the WiFi 7 EPCS handling code in net/mac80211
Systems using the mac80211 stack with Multi-Link Device (MLD) support enabled
Linux distributions shipping affected stable kernel branches prior to the fix commits

Discovery Timeline

2026-07-19 - CVE-2026-64030 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64030

Vulnerability Analysis

The vulnerability lives in ieee80211_ml_epcs() in the Linux kernel mac80211 driver. The mask IEEE80211_MLE_STA_EPCS_CONTROL_LINK_ID is 0x000f, allowing link_id values from 0 through 15. However, sdata->link[] is sized by IEEE80211_MLD_MAX_NUM_LINKS, which is 15, giving valid indices 0 through 14. Index 15 reads past the end of the array.

The out-of-bounds read lands in the first word of sdata->activate_links_work, a wiphy_work structure whose embedded list_head becomes non-NULL after INIT_LIST_HEAD. The existing NULL check on the returned pointer therefore fails to detect the invalid access. The garbage pointer is subsequently passed to ieee80211_sta_wmm_params(), which dereferences link->sdata and crashes the kernel.

Root Cause

The root cause is a missing bounds check [CWE-125 Out-of-Bounds Read] on attacker-controlled data parsed from a wireless management frame. The same defect class was previously fixed in ieee80211_ml_reconfiguration() by commit 162d331d833d, but the equivalent check was absent from the EPCS handler.

Attack Vector

Exploitation requires the victim to be associated to a WiFi 7 access point that has EPCS enabled. Because the unsolicited-notification path uses dialog_token = 0, the malicious AP can send an EPCS Enable Response action frame at any time without a prior client request. The attacker sets link_id = 15 inside the PER_STA_PROFILE subelement, triggering the out-of-bounds access and kernel panic. The attack requires adjacent network access and no user interaction.

No public exploit code is available. See the upstream fix at Kernel Git Commit Fix for the sanitizing patch.

Detection Methods for CVE-2026-64030

Indicators of Compromise

Unexpected kernel panics or BUG/Oops traces referencing ieee80211_ml_epcs, ieee80211_sta_wmm_params, or mac80211 on WiFi 7 client systems
Repeated wireless disconnects immediately following association with a specific WiFi 7 AP
Unusual EPCS Enable Response action frames captured with dialog_token = 0 and PER_STA_PROFILE subelements referencing link_id = 15

Detection Strategies

Capture 802.11 management frames near affected clients using tcpdump or airmon-ng and filter for EPCS action frames with anomalous link_id values
Monitor kernel ring buffer output via dmesg and centralized log collection for mac80211 fault signatures
Correlate wireless client crashes with proximity to unknown or rogue WiFi 7 access points broadcasting MLO capabilities

Monitoring Recommendations

Forward journalctl -k and /var/log/kern.log output to a centralized logging platform for kernel-level anomaly detection
Alert on repeated mac80211 warnings or wiphy reset events across a fleet of WiFi 7-capable Linux endpoints
Track kernel version and patch status across the Linux estate to identify unpatched hosts exposed to nearby WiFi networks

How to Mitigate CVE-2026-64030

Immediate Actions Required

Apply the upstream kernel patches referenced by commits 2d8379834800, 863f1f02a3bd, and f718506edd2d as soon as vendor-supplied builds are available
Inventory Linux systems running WiFi 7 (802.11be) capable hardware and prioritize them for patching
Restrict association of critical Linux endpoints to trusted, managed access points until fixes are deployed

Patch Information

The fix adds a bounds check on link_id before indexing sdata->link[] in ieee80211_ml_epcs(), mirroring the earlier remediation in ieee80211_ml_reconfiguration() (commit 162d331d833d). Distribution maintainers are backporting the change to supported stable branches. Refer to the Kernel Git Commit Update, Kernel Git Commit Fix, and Kernel Git Commit Change for the authoritative source changes.

Workarounds

Disable WiFi 7 Multi-Link Operation on affected clients where the driver or iw/nl80211 interface permits, forcing single-link association
Avoid connecting affected Linux systems to untrusted or public WiFi 7 networks until patched builds are installed
Where operationally feasible, disable the wireless interface on servers that do not require Wi-Fi connectivity

bash

# Example: unload the wireless stack on systems that do not require Wi-Fi
sudo rfkill block wifi
sudo modprobe -r mac80211