Data Handling Flaw in Linux Kernel Affecting WiFi Functionality

CVE-2026-68402

What is CVE-2026-68402?

A vulnerability exists in the Linux kernel's cfg80211 module, which fails to properly validate data length in certain WiFi elements. When processing non-inherited extension elements, the function cfg80211_is_element_inherited may attempt to read past valid memory boundaries if it encounters an empty data octet. This flaw can lead to out-of-bounds reads, creating a potential for exploitation through carefully crafted frames that trigger the vulnerability during frame parsing, specifically under contexts involving Multi-Link elements.

References