Medium 5.5Published Jul 19, 2026

CVE-2026-64174wifi: cfg80211: advance loop vars in cfg80211_merge_profile()

Updated under an hour ago (Oct 27, 2026, 1:00 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: advance loop vars in cfg80211_merge_profile() cfg80211_merge_profile() reassembles a Multi-BSSID non-transmitted BSS profile that has been split across multiple consecutive MBSSID elements. Its while-loop calls cfg80211_get_profile_continuation(ie, ielen, mbssid_elem, sub_elem) but never advances mbssid_elem or sub_elem inside the body. Each iteration therefore searches for a continuation that follows the same fixed pair; the helper returns the same next_mbssid; and the same next_sub bytes are memcpy()'d into merged_ie at a growing offset until the buffer fills. Advance both mbssid_elem and sub_elem to the just-consumed continuation so the next call to cfg80211_get_profile_continuation() searches for a further continuation beyond it (or returns NULL when none exists). A specially-crafted malicious beacon can take advantage of this bug to cause the kernel to spend an excessive amount of time in cfg80211_merge_profile (up to as much as 2ms per beacon received), which could theoretically be abused in some way.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Jul 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from fe806e4992c9047affd263bcc13b2c047029a726 before 5817e1e5205498a5df66eba2b34e817f4210fd0f; from fe806e4992c9047affd263bcc13b2c047029a726 before cedbb608494ba1e7a5c6c56b7f1d3fd470094f28; from fe806e4992c9047affd263bcc13b2c047029a726 before c0bc4c8bd556cbe036a5b9ed333c0aab9aadfcb8; from fe806e4992c9047affd263bcc13b2c047029a726 before 1ced0f5a851f9cae274545a42a06c459b7fd8881; from fe806e4992c9047affd263bcc13b2c047029a726 before 67915715fd3874057457363c87c63e18829527df; from fe806e4992c9047affd263bcc13b2c047029a726 before 6cfae4914439878b8acb35c7e3b40096eeb2ad9c; from fe806e4992c9047affd263bcc13b2c047029a726 before 1343a480f84b80c1249133a90ef87f8751d65cbb; from fe806e4992c9047affd263bcc13b2c047029a726 before 7666dbb1bacc4ba522b96740cba7283d243d16e1	CNA record
linux linux_kernel linux:linux_kernel	from 5.2 before 5.10.258; from 5.11 before 5.15.209; from 5.16 before 6.1.175; from 6.2 before 6.6.142; from 6.7 before 6.12.92; from 6.13 before 6.18.34; from 6.19 before 7.0.11; 7.1; and 3 more ranges	NVD

References

References

https://git.kernel.org/stable/c/5817e1e5205498a5df66eba2b34e817f4210fd0f	patch
https://git.kernel.org/stable/c/cedbb608494ba1e7a5c6c56b7f1d3fd470094f28	patch
https://git.kernel.org/stable/c/c0bc4c8bd556cbe036a5b9ed333c0aab9aadfcb8	patch
https://git.kernel.org/stable/c/1ced0f5a851f9cae274545a42a06c459b7fd8881	patch
https://git.kernel.org/stable/c/67915715fd3874057457363c87c63e18829527df	patch
https://git.kernel.org/stable/c/6cfae4914439878b8acb35c7e3b40096eeb2ad9c	patch
https://git.kernel.org/stable/c/1343a480f84b80c1249133a90ef87f8751d65cbb	patch
https://git.kernel.org/stable/c/7666dbb1bacc4ba522b96740cba7283d243d16e1	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.