CVE-2026-23246

Root

Cause

The vulnerability resides in the ieee80211_ml_reconfiguration function in the Linux kernel's mac80211 subsystem. The link_id value, extracted from the ML Reconfiguration element (control & 0x000f), can range from 0 to 15. However, the link_removal_timeout[] array is sized to IEEE80211_MLD_MAX_NUM_LINKS (15 elements), meaning index 15 is out-of-bounds. This lack of bounds checking can result in a stack out-of-bounds write [1][2].

Exploitation

An attacker must be able to transmit a crafted Multi-Link Reconfiguration element to a station that processes it. This typically requires the attacker to be within radio range and authenticated as a client. By supplying a link_id of 15 (or higher), an out-of-bounds write occurs on the stack, corrupting adjacent memory [3].

Impact

A successful exploit can corrupt kernel memory, potentially leading to denial of service or privilege escalation. The CVSSv3 score of 8.8 reflects the high impact on confidentiality, integrity, and availability, though the attack complexity is low and no privileges are required but user interaction may be limited [description].

Mitigation

The fix, which adds a bounds check to skip subelements with link_id >= IEEE80211_MLD_MAX_NUM_LINKS, has been applied to stable kernel trees. Administrators should update to patched versions as soon as possible [1][2][3][4].