High 8.8Published Mar 18, 2026

CVE-2026-23246wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration

Updated under an hour ago (Oct 27, 2026, 7:20 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration link_id is taken from the ML Reconfiguration element (control & 0x000f), so it can be 0..15. link_removal_timeout[] has IEEE80211_MLD_MAX_NUM_LINKS (15) elements, so index 15 is out-of-bounds. Skip subelements with link_id >= IEEE80211_MLD_MAX_NUM_LINKS to avoid a stack out-of-bounds write.

CVSS: 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 8eb8dd2ffbbb6b0b8843b66754ee9f129f1b2d6c before 650981e718e68005ca2760a6358134b8a98ebea4; from 8eb8dd2ffbbb6b0b8843b66754ee9f129f1b2d6c before bfde158d5d1322c0c2df398a8d1ccce04943be2e; from 8eb8dd2ffbbb6b0b8843b66754ee9f129f1b2d6c before f35ceec54d48e227fa46f8f97fd100a77b8eab15; from 8eb8dd2ffbbb6b0b8843b66754ee9f129f1b2d6c before d58d71c2167601762351962b9604808d3be94400; from 8eb8dd2ffbbb6b0b8843b66754ee9f129f1b2d6c before 162d331d833dc73a3e905a24c44dd33732af1fc5	CNA record
linux linux_kernel linux:linux_kernel	from 6.5.1 before 6.6.130; from 6.7 before 6.12.77; from 6.13 before 6.18.17; from 6.19 before 6.19.7; 6.5; 7.0	NVD

References

References

https://git.kernel.org/stable/c/650981e718e68005ca2760a6358134b8a98ebea4	patch
https://git.kernel.org/stable/c/bfde158d5d1322c0c2df398a8d1ccce04943be2e	patch
https://git.kernel.org/stable/c/f35ceec54d48e227fa46f8f97fd100a77b8eab15	patch
https://git.kernel.org/stable/c/d58d71c2167601762351962b9604808d3be94400	patch
https://git.kernel.org/stable/c/162d331d833dc73a3e905a24c44dd33732af1fc5	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.