CVE-2026-64223: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64223 Overview

CVE-2026-64223 is an out-of-bounds read vulnerability in the Linux kernel mac80211 subsystem. The flaw resides in ieee80211_parse_neg_ttlm(), which parses negotiated Traffic-to-Link Mapping (TTLM) elements used in Wi-Fi 7 multi-link operation. The parser advances its cursor for every Traffic Identifier (TID), including TIDs whose presence bit is clear and therefore have no map bytes in the element. A sparse presence map can cause a later present TID to read past the validated element boundary.

Critical Impact
An adjacent-network attacker within Wi-Fi range can trigger a slab-out-of-bounds read in the kernel, potentially causing memory disclosure or denial of service on affected hosts.

Affected Products

Linux kernel mac80211 subsystem versions containing the vulnerable ieee80211_parse_neg_ttlm() implementation
Wi-Fi 7 capable systems performing Multi-Link Operation (MLO) with negotiated TTLM
Linux distributions shipping affected stable kernel branches prior to the patched commits

Discovery Timeline

2026-07-24 - CVE-2026-64223 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64223

Vulnerability Analysis

The vulnerability affects the parsing of IEEE 802.11 negotiated TTLM elements in the Linux kernel wireless stack. The validation function ieee80211_tid_to_link_map_size_ok() checks negotiated TTLM elements against the number of link-map entries indicated by link_map_presence. However, the corresponding parser ieee80211_parse_neg_ttlm() does not consume the same layout.

The parser incorrectly advances its byte cursor for every TID slot from 0 through 7, regardless of whether the TID's presence bit is set in link_map_presence. Because absent TIDs occupy no bytes in the on-wire element, this cursor mismatch causes subsequent present TIDs to read from memory beyond the validated element buffer. Under KUnit with KASAN and an exact-sized element allocation, the out-of-bounds read is reported as a slab-out-of-bounds.

The out-of-bounds bytes are stored in neg_ttlm->uplink[tid] and neg_ttlm->downlink[tid]. These values are gated by valid_links before being applied to driver state, so a remote peer cannot convert the read into an arbitrary policy change on the victim.

Root Cause

The root cause is a layout inconsistency between the size validator and the parser [CWE-125]. The validator sizes the element strictly by counting bits set in link_map_presence, while the parser walks a fixed 8-TID loop and unconditionally advances the cursor. Sparse presence bitmaps break this invariant and drive the read pointer past the trusted length.

Attack Vector

Exploitation requires an attacker within adjacent Wi-Fi range of the target station. The attacker must be a peer capable of transmitting a crafted management frame containing a negotiated TTLM element with a sparse link_map_presence field. No user interaction and no authentication credentials are required to reach the vulnerable parser path. Successful triggering results in a kernel slab-out-of-bounds read, which may manifest as kernel memory disclosure into local structures or as a kernel panic depending on adjacent allocator state.

No verified public exploit code is available. See the upstream fix commits for the corrected parser logic: Kernel fix commit a6e6ccd5, commit 2becaaee, commit 2dd93047, and commit f7d395dc.

Detection Methods for CVE-2026-64223

Indicators of Compromise

KASAN slab-out-of-bounds reports in kernel logs referencing ieee80211_parse_neg_ttlm or nearby mac80211 symbols
Unexplained kernel panics or oopses on Wi-Fi 7 client devices during association or link reconfiguration with untrusted access points
Repeated 802.11 management frames from a peer carrying malformed or sparse TTLM elements

Detection Strategies

Build and boot test kernels with KASAN enabled to surface any out-of-bounds access originating in the mac80211 TTLM parse path
Monitor dmesg and journalctl -k for KASAN warnings, WARN_ON traces, or oops signatures tied to wireless RX handlers
Capture 802.11 traffic in monitor mode and inspect TTLM information elements whose declared link_map_presence bitmap does not match the element length

Monitoring Recommendations

Forward kernel logs from Linux endpoints to a centralized logging platform and alert on KASAN and mac80211 crash signatures
Track kernel package versions across the fleet and flag hosts still running unpatched stable branches
Correlate wireless client crash events with nearby SSID and BSSID telemetry to identify hostile access points

How to Mitigate CVE-2026-64223

Immediate Actions Required

Apply the upstream Linux kernel patches that advance the TTLM parser cursor only when the current TID has a map present
Update all Wi-Fi 7 capable Linux endpoints, laptops, and embedded devices to a patched stable kernel from your distribution vendor
Restrict association of sensitive hosts to trusted, managed wireless infrastructure until patches are deployed

Patch Information

The fix modifies ieee80211_parse_neg_ttlm() to advance its cursor only when the corresponding TID bit is set in link_map_presence, restoring layout parity with ieee80211_tid_to_link_map_size_ok(). The corrected logic is available in the stable tree commits a6e6ccd5bd07, 2becaaeebe23, 2dd9304727c7, and f7d395dc5008. Distribution maintainers should pull these commits into supported stable branches and rebuild kernel packages.

Workarounds

Disable Wi-Fi 7 Multi-Link Operation on affected clients where the driver or iw tooling exposes such a control
Unload the vulnerable wireless driver on servers that do not require Wi-Fi connectivity: modprobe -r <driver>
Constrain wireless clients to WPA3-Enterprise networks with validated RADIUS-backed peers to reduce exposure to arbitrary adjacent transmitters

bash

# Verify running kernel version and confirm patched build is loaded
uname -r

# Check whether mac80211 is loaded and in use
lsmod | grep mac80211

# Temporarily disable wireless interfaces on hosts that do not require Wi-Fi
nmcli radio wifi off