{"id":"CVE-2026-64117","revision":"96d326a4a7774d3ba81ead0d49b5b386","records":[{"revision":"96d326a4a7774d3ba81ead0d49b5b386","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-64117","aliases":[],"title":"wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: capture fast-RX rate before mesh reuses skb->cb\n\nieee80211_invoke_fast_rx() reads RX status through\nIEEE80211_SKB_RXCB(skb), which aliases the same skb->cb storage\nthat ieee80211_rx_mesh_data() reuses as IEEE80211_TX_INFO.  In the\nunicast forward path, mesh_data does:\n\n\tinfo = IEEE80211_SKB_CB(fwd_skb);\n\tmemset(info, 0, sizeof(*info));\n\non the same skb the caller still names via rx->skb, then either\nqueues the skb for TX (success) or kfree_skb()'s it (no-route)\nbefore returning RX_QUEUED.  The caller's RX_QUEUED arm then\ncalls sta_stats_encode_rate(status) on memory that is either\nzeroed (success path) or freed (no-route path).  The latter is\nKASAN slab-use-after-free in ieee80211_prepare_and_rx_handle.\n\nFix by encoding the rate from status before invoking\nieee80211_rx_mesh_data(), so the RX_QUEUED arm consumes a value\ncaptured while status was still backed by valid memory.","state":0,"publishedAt":"2026-07-19T15:40:16.941+00:00","modifiedAt":"2026-10-21T12:43:04.607+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/mac80211/rx.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3468e1e0c639032a603450f0830ccabfa76f5806\",\n                            \"lessThan\": \"5fe97797412aa8bc0184f78379fafb594bcb7f66\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3468e1e0c639032a603450f0830ccabfa76f5806\",\n                            \"lessThan\": \"0cd37e746e98ab0baa6d8b812955220775b080d6\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3468e1e0c639032a603450f0830ccabfa76f5806\",\n                            \"lessThan\": \"a2650f8461cd8ba287fee2992b36abe733c2bd5e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3468e1e0c639032a603450f0830ccabfa76f5806\",\n                            \"lessThan\": \"2fb64f94f9afb774f2fa0c7835727d7a67f89f07\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3468e1e0c639032a603450f0830ccabfa76f5806\",\n                            \"lessThan\": \"d71c841be5d9e586ee7f36c0dc8ed4db0d9a1349\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/mac80211/rx.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.4\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.4\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.160\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.114\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.57\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0.11\",\n                            \"lessThanOrEqual\": \"7.0.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/5fe97797412aa8bc0184f78379fafb594bcb7f66","https://git.kernel.org/stable/c/0cd37e746e98ab0baa6d8b812955220775b080d6","https://git.kernel.org/stable/c/a2650f8461cd8ba287fee2992b36abe733c2bd5e","https://git.kernel.org/stable/c/2fb64f94f9afb774f2fa0c7835727d7a67f89f07","https://git.kernel.org/stable/c/d71c841be5d9e586ee7f36c0dc8ed4db0d9a1349"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64117","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-64117","identifiers":["CVE-2026-64117"]},"retained":false,"historicalAffected":[]}],"coverage":[]}