CVE-2026-68470
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
In the Linux kernel's mac80211 subsystem, a vulnerability exists due to missing validation of extension frame layout before processing. Unsupported extension subtypes can reach code that reads regular headers, potentially leading to improper reads. The fix adds validation and appropriate processing paths for S1G beacon frames.
Risk Assessment
An attacker could send specially crafted frames, potentially causing system malfunction or privilege escalation. This may compromise system stability or enable integrity attacks.
Recommendation
Apply the Linux kernel update containing the fix for CVE-2026-68470. Ensure systems with Wi-Fi support have the updated kernel.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate extension-frame layout before RX Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can still reach helpers and interface dispatch code that read regular header address fields before unsupported extension subtypes are dropped. mac80211 currently only handles S1G beacon extension frames. Drop other extension subtypes before they can reach regular-header RX processing. For S1G beacons, linearize the SKB with the management-frame path and require the fixed S1G beacon header, including optional fixed fields indicated by frame control, before generic RX dispatch. Route S1G beacons through the station/default-link RX path without regular-header station lookup. Avoid regular-header address reads in the mac80211 RX paths that process S1G extension beacons, including accept-frame, duplicate-detection, address-copy, and MLO address-translation paths. Also make ieee80211_get_bssid() length-safe before returning the S1G source-address pointer.