{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-64223","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-07-19T15:36:31.770Z","datePublished":"2026-07-24T15:23:08.629Z","dateUpdated":"2026-08-05T12:40:10.599Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:40:10.599Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: consume only present negotiated TTLM maps\n\nieee80211_tid_to_link_map_size_ok() validates negotiated TTLM elements\nagainst the number of link-map entries indicated by link_map_presence.\nieee80211_parse_neg_ttlm() must consume the same layout.\n\nThe parser advanced its cursor for every TID, including TIDs whose\npresence bit is clear and therefore have no map bytes in the element.\nA sparse map can then make a later present TID read past the validated\nelement.\n\nThe bad bytes land in neg_ttlm->{up,down}link[tid] but are gated by\nvalid_links before being applied to driver state, so a peer cannot\nturn the read into a policy change.  Under KUnit + KASAN with an\nexact-sized element allocation the OOB read is reported as a\nslab-out-of-bounds; whether the same trigger fires under the\nproduction RX path depends on surrounding allocator state.\n\nAdvance the cursor only when the current TID has a map present."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":8.1,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:A - A malicious or spoofed Wi-Fi 7 MLO peer can trigger the parser using an over-the-air Protected EHT TTLM request, requiring radio-network adjacency.\nAC:L - A crafted sparse link_map_presence deterministically causes the invalid cursor advancement and OOB read; no race or condition outside the attacker’s control is required to reach the flaw.\nPR:N - The attacker needs no local account, capability, or target-system privilege; an associated malicious AP/MLD peer can supply the frame.\nUI:N - Once the station is connected to the malicious or compromised AP, the crafted management frame is processed automatically without user action.\nS:U - The vulnerable parser and resulting impacts remain within the host kernel’s existing security authority and do not cross a VM, IOMMU, or sandbox boundary.\nC:H - Sparse maps cause multiple one- or two-byte reads beyond the validated element into surrounding kernel allocation state. Applying the required higher-severity choice for an OOB kernel read, potential disclosure of adjacent kernel memory is scored High.\nI:N - All writes remain within the bounded neg_ttlm arrays, and parsed link values are checked against valid_links before driver-state application; there is no OOB write or control-flow corruption primitive.\nA:H - An exact-sized allocation produces a KASAN slab-out-of-bounds report, which can panic sanitizer-enabled kernels, and the peer can repeatedly send the trigger. Although production behavior depends on RX-buffer allocation state, the required higher-severity choice supports High."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/mac80211/mlme.c"],"versions":[{"version":"8f500fbc6c655976c8062b1f1e55bd0b3095d6c2","lessThan":"f7d395dc5008168ac5b9c1ac2791e59a6078cca1","status":"affected","versionType":"git"},{"version":"8f500fbc6c655976c8062b1f1e55bd0b3095d6c2","lessThan":"2dd9304727c7041df0a599595910bdbe02ad03c5","status":"affected","versionType":"git"},{"version":"8f500fbc6c655976c8062b1f1e55bd0b3095d6c2","lessThan":"2becaaeebe230ade1fcd5d0f1cde4d6ee93ec78f","status":"affected","versionType":"git"},{"version":"8f500fbc6c655976c8062b1f1e55bd0b3095d6c2","lessThan":"a6e6ccd5bd07155c2add6c74ce1a5e68ad3b95ea","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/mac80211/mlme.c"],"versions":[{"version":"6.9","status":"affected"},{"version":"0","lessThan":"6.9","status":"unaffected","versionType":"semver"},{"version":"6.12.92","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.34","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.0.11","lessThanOrEqual":"7.0.*","status":"unaffected","versionType":"semver"},{"version":"7.1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.9","versionEndExcluding":"6.12.92"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.9","versionEndExcluding":"6.18.34"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.9","versionEndExcluding":"7.0.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.9","versionEndExcluding":"7.1"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/f7d395dc5008168ac5b9c1ac2791e59a6078cca1"},{"url":"https://git.kernel.org/stable/c/2dd9304727c7041df0a599595910bdbe02ad03c5"},{"url":"https://git.kernel.org/stable/c/2becaaeebe230ade1fcd5d0f1cde4d6ee93ec78f"},{"url":"https://git.kernel.org/stable/c/a6e6ccd5bd07155c2add6c74ce1a5e68ad3b95ea"}],"title":"wifi: mac80211: consume only present negotiated TTLM maps","x_generator":{"engine":"bippy-1.2.0"}}}}