CVE-2026-64174 Overview
CVE-2026-64174 is a Linux kernel vulnerability in the cfg80211 wireless configuration subsystem. The flaw resides in cfg80211_merge_profile(), which reassembles Multi-BSSID (MBSSID) non-transmitted BSS profiles split across multiple consecutive MBSSID elements. The function's while-loop fails to advance the mbssid_elem and sub_elem pointers between iterations. A specially crafted malicious beacon frame can exploit this bug to force the kernel to spend excessive time inside cfg80211_merge_profile() — up to 2ms per received beacon.
Critical Impact
A remote attacker within wireless range can transmit crafted beacon frames that cause the Linux kernel to consume excessive CPU time processing each beacon, producing a denial-of-service condition on wireless clients.
Affected Products
- Linux kernel versions containing the vulnerable cfg80211_merge_profile() implementation
- Systems using the cfg80211 wireless configuration framework
- Wi-Fi client devices that parse Multi-BSSID beacon elements
Discovery Timeline
- 2026-07-19 - CVE-2026-64174 published to NVD
- 2026-07-19 - Last updated in NVD database
Technical Details for CVE-2026-64174
Vulnerability Analysis
The vulnerability sits in cfg80211_merge_profile(), a helper in the Linux kernel cfg80211 subsystem that reassembles a Multi-BSSID non-transmitted BSS profile split across consecutive MBSSID information elements. The function iterates through beacon elements to concatenate profile fragments into a single merged buffer. This is a resource exhaustion issue triggered through malformed 802.11 management frames.
Each loop iteration calls cfg80211_get_profile_continuation(ie, ielen, mbssid_elem, sub_elem) to locate the next continuation fragment. The function then copies the returned next_sub bytes into merged_ie at an incrementing offset. Because the loop parameters remain constant, the helper repeatedly returns the same continuation until the destination buffer fills.
Root Cause
The root cause is a missing pointer advance inside the merge loop. Neither mbssid_elem nor sub_elem is updated to reference the continuation just consumed. As a result, cfg80211_get_profile_continuation() restarts its search from the same fixed pair on every iteration and returns the same next_mbssid and next_sub values.
The fix advances both mbssid_elem and sub_elem to the just-consumed continuation. Subsequent calls then search past the previously handled fragment or return NULL when no further continuation exists, terminating the loop correctly.
Attack Vector
An attacker within wireless range broadcasts a specially crafted beacon frame containing multiple MBSSID elements structured to trigger the merge path. Every affected station that scans or associates while receiving the beacon executes the expensive loop, spending up to 2ms of kernel CPU time per beacon received. Sustained transmission of malicious beacons theoretically degrades wireless client performance and could be abused to amplify other attacks.
No code execution primitive is exposed. The impact is limited to CPU consumption and possible responsiveness degradation on wireless subsystem processing.
Detection Methods for CVE-2026-64174
Indicators of Compromise
- Wireless beacon frames containing unusually long or repeated MBSSID element chains observed by monitor-mode captures
- Kernel CPU spikes localized to soft-IRQ or wireless worker threads on Linux Wi-Fi clients during scans
- Prolonged latency or unresponsiveness on Wi-Fi interfaces coincident with proximity to unknown access points
Detection Strategies
- Capture 802.11 beacon frames with monitor-mode tooling and inspect MBSSID element sequences for malformed continuation patterns
- Correlate kernel scheduler and soft-IRQ CPU metrics with wireless scan activity to identify anomalous processing time
- Track kernel versions across the fleet and flag hosts running builds that predate the upstream cfg80211_merge_profile() fix
Monitoring Recommendations
- Monitor /proc/interrupts and per-CPU soft-IRQ utilization on wireless-connected Linux endpoints for sustained spikes
- Alert on repeated wireless driver warnings or scan completion timeouts in dmesg and journalctl output
- Ingest endpoint telemetry into a centralized data lake to baseline wireless subsystem CPU behavior across the environment
How to Mitigate CVE-2026-64174
Immediate Actions Required
- Apply the upstream Linux kernel patches that advance mbssid_elem and sub_elem inside cfg80211_merge_profile()
- Update to a distribution kernel that incorporates the fixes referenced in the kernel.org stable commits
- Prioritize patching mobile and laptop fleets that frequently connect to untrusted wireless networks
Patch Information
The fix is available in multiple stable Linux kernel branches. Relevant commits include 1343a480f84b, 1ced0f5a851f, 5817e1e52054, 67915715fd38, 6cfae4914439, 7666dbb1bacc, c0bc4c8bd556, and cedbb608494b.
Workarounds
- Disable background wireless scanning on affected clients when operating in untrusted RF environments
- Restrict wireless client associations to known SSIDs using enterprise Wi-Fi profiles until patches are deployed
- Where feasible, disable the wireless interface on Linux devices that do not require Wi-Fi connectivity
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
