{"id":"CVE-2026-64030","revision":"83dd82e238684b88873521e9fd237d81","records":[{"revision":"83dd82e238684b88873521e9fd237d81","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-64030","aliases":[],"title":"wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: bounds-check link_id in ieee80211_ml_epcs\n\nIEEE80211_MLE_STA_EPCS_CONTROL_LINK_ID is 0x000f, so link_id extracted\nfrom a PRIO_ACCESS ML element PER_STA_PROFILE subelement can be 0..15.\nsdata->link[] has IEEE80211_MLD_MAX_NUM_LINKS (15) entries (indices 0..14),\nmaking index 15 out-of-bounds.\n\nA connected WiFi 7 AP can trigger this by sending an EPCS Enable Response\naction frame with a PER_STA_PROFILE subelement where link_id = 15.  The\nunsolicited-notification path (dialog_token = 0) is reachable any time\nEPCS is already enabled, without any prior client request.\n\nsdata->link[15] reads into the first word of sdata->activate_links_work\n(a wiphy_work whose embedded list_head is non-NULL after INIT_LIST_HEAD),\nso the NULL check on the result does not catch the invalid access.  The\ngarbage pointer is then passed to ieee80211_sta_wmm_params(), which\ndereferences link->sdata and crashes the kernel.\n\nThe same class of bug was fixed for ieee80211_ml_reconfiguration() by\ncommit 162d331d833d (\"wifi: mac80211: bounds-check link_id in\nieee80211_ml_reconfiguration\").","state":0,"publishedAt":"2026-07-19T15:39:20.982+00:00","modifiedAt":"2026-10-19T20:28:09.581+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/mac80211/mlme.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"de86c5f60839dc0d771711a848b4f55ad3f90844\",\n                            \"lessThan\": \"2d8379834800c30602f24c71ab7c40f5fe84d200\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"de86c5f60839dc0d771711a848b4f55ad3f90844\",\n                            \"lessThan\": \"863f1f02a3bd70dbd857b8ac4070292fde8cb4e2\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"de86c5f60839dc0d771711a848b4f55ad3f90844\",\n                            \"lessThan\": \"f718506edd2d9c6a308ded9d13c632bf7b7d5a2c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/mac80211/mlme.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.15\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.15\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.34\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0.11\",\n                            \"lessThanOrEqual\": \"7.0.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/2d8379834800c30602f24c71ab7c40f5fe84d200","https://git.kernel.org/stable/c/863f1f02a3bd70dbd857b8ac4070292fde8cb4e2","https://git.kernel.org/stable/c/f718506edd2d9c6a308ded9d13c632bf7b7d5a2c"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64030","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-64030","identifiers":["CVE-2026-64030"]},"retained":false,"historicalAffected":[]}],"coverage":[]}