CVE-2026-68406: Linux Kernel PMSR FTM Vulnerability

CVE-2026-68406 Overview

CVE-2026-68406 is an input validation flaw in the Linux kernel's cfg80211 wireless configuration subsystem. The vulnerability affects Peer Measurement (PMSR) Fine Timing Measurement (FTM) request parsing. The parser accepts preamble values that fall outside the enumerated nl80211 preamble range before performing a capability bit test. The upstream fix rejects out-of-range values using the netlink policy prior to the parser capability bit test.

Critical Impact
Out-of-range preamble values reach the FTM parser capability bit test, creating an input validation gap in cfg80211 PMSR handling that patched kernels now block via policy enforcement.

Affected Products

Linux kernel cfg80211 subsystem (wifi stack)
Kernel builds handling nl80211 PMSR FTM requests
Distributions shipping unpatched stable kernel branches

Discovery Timeline

2026-08-10 - CVE-2026-68406 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68406

Vulnerability Analysis

The defect resides in cfg80211 PMSR FTM request parsing. PMSR is the Linux wireless framework used to schedule measurement operations, and FTM is the 802.11 protocol used to estimate distance between a station and a responder. The FTM request carries a preamble field enumerated by nl80211. The parser used the supplied preamble to index a capability bit test without first validating that the value fell inside the enumerated range. Any out-of-range value therefore reached the capability check unfiltered, an [CWE-20] input validation weakness.

Root Cause

The netlink attribute policy did not constrain the preamble attribute to the enumerated nl80211_preamble values. The parser trusted the value and used it directly in the capability bit test. The patch enforces range validation through the netlink policy so that out-of-range values are rejected before parsing continues. The commit note also drops a now-redundant runtime check.

Attack Vector

Exploitation requires the ability to submit crafted nl80211 PMSR FTM requests to the kernel. This is a local interface reached through netlink sockets, typically requiring CAP_NET_ADMIN. A caller with that capability can send preamble values outside the enumerated range and reach the unvalidated parser path. The vulnerability is a validation gap; no public proof-of-concept, exploit code, or in-the-wild activity is associated with this CVE.

No verified exploit code is published for CVE-2026-68406. Consult the upstream commits linked in the references for the exact parser and policy changes.

Detection Methods for CVE-2026-68406

Indicators of Compromise

No public indicators of compromise are associated with CVE-2026-68406.
No known exploitation in the wild has been reported, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Strategies

Inventory Linux endpoints and servers by kernel version and compare against fixed stable branches referenced in the upstream commits.
Track kernel package versions across the fleet and flag hosts whose cfg80211 module predates the patched commits.
Review distribution security trackers for backport status of commits 36230936, 44ea65d7, 58320cb4, 922d71fb, and cfbda103.

Monitoring Recommendations

Audit which local accounts and services hold CAP_NET_ADMIN and can issue nl80211 PMSR requests.
Monitor kernel log messages from the cfg80211 subsystem for netlink policy validation failures after patching.
Log package management events to confirm kernel updates deploy successfully across managed hosts.

How to Mitigate CVE-2026-68406

Immediate Actions Required

Apply the vendor kernel update that includes the cfg80211 PMSR FTM preamble range validation fix.
Reboot patched systems so the updated kernel image loads and the corrected cfg80211 module is in use.
Restrict CAP_NET_ADMIN to trusted service accounts on multi-user Linux hosts until patched kernels are deployed.

Patch Information

The fix is available in the Linux stable tree through five commits: Linux Kernel Commit 36230936, Linux Kernel Commit 44ea65d7, Linux Kernel Commit 58320cb4, Linux Kernel Commit 922d71fb, and Linux Kernel Commit cfbda103. Consume the patched kernel through your distribution's stable update channel.

Workarounds

Limit which processes can open nl80211 netlink sockets by restricting CAP_NET_ADMIN and applying appropriate seccomp or LSM policies.
Disable wireless interfaces on systems that do not require Wi-Fi so cfg80211 PMSR paths cannot be exercised.
Track upstream stable kernel releases and pull the fix as soon as your distribution publishes an updated package.

bash

# Verify running kernel version and confirm patched build is loaded
uname -r

# Inspect cfg80211 module details
modinfo cfg80211 | grep -E 'version|filename'

# Review which accounts have CAP_NET_ADMIN via capsh (example)
capsh --print