{"id":"CVE-2026-74336","revision":"9ff7ec430af6434a896463574b75d900","records":[{"revision":"9ff7ec430af6434a896463574b75d900","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-74336","aliases":[],"title":"wifi: mac80211: bound S1G TIM PVB walk to the TIM element","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: bound S1G TIM PVB walk to the TIM element\n\nieee80211_s1g_check_tim() parses the S1G Partial Virtual Bitmap (PVB) of a\nreceived TIM element. The TIM is handed in as the element payload:\nieee802_11_parse_elems_full() stores elems->tim = elem->data and\nelems->tim_len = elem->datalen (net/mac80211/parse.c), so the valid bytes\nare [tim, tim + tim_len).\n\nWhen walking the encoded blocks the function passes the walker an end\nsentinel of (const u8 *)tim + tim_len + 2, i.e. two bytes past the end of\nthe element. ieee80211_s1g_find_target_block() loops while (ptr + 1 <= end)\nand dereferences ptr (and the per-mode ieee80211_s1g_len_*() helpers read\n*ptr), so it can read up to two bytes beyond the TIM element -- an\nout-of-bounds read of adjacent skb/heap data when the TIM is the last\nelement in the frame. The +2 appears to account for the element id/len\nheader, but tim already points past that header at the element payload, so\nthe addend is wrong.\n\nPass the correct element end, (const u8 *)tim + tim_len.","state":0,"publishedAt":"2026-08-15T05:58:27.799+00:00","modifiedAt":"2026-10-15T10:08:55.597+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"include/linux/ieee80211-s1g.h\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"e0c47c6229c25b54440fe1f84a0ff533942290b1\",\n                            \"lessThan\": \"68cf46755894d495b432e21f9e25637030d8b075\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e0c47c6229c25b54440fe1f84a0ff533942290b1\",\n                            \"lessThan\": \"3abc13ec3ac28c343ad7e7b7496e807b924f0edd\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e0c47c6229c25b54440fe1f84a0ff533942290b1\",\n                            \"lessThan\": \"b224d18b1e5d1cddfc67f63f41d80023b2ec8889\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"include/linux/ieee80211-s1g.h\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.18\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.18\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.57\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.5\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/68cf46755894d495b432e21f9e25637030d8b075","https://git.kernel.org/stable/c/3abc13ec3ac28c343ad7e7b7496e807b924f0edd","https://git.kernel.org/stable/c/b224d18b1e5d1cddfc67f63f41d80023b2ec8889"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74336","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-74336","identifiers":["CVE-2026-74336"]},"retained":false,"historicalAffected":[]}],"coverage":[]}