EUVD-2026-55598

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: Fix an error handling path in cfg80211wextsiwscan If the test against IEEE80211MAXSSIDLEN fails, then 'creq' leaks. Use the existing error handling path to fix it...

CVE-2026-68407

CVE-2026-68407 relates to the Linux kernel wifi stack (nl80211). The issue occurs in nl80211_parse_beacon() where EMA RNR data is rejected when the number of RNR entries is fewer than MBSSID entries, leaving a previously allocated RNR block potentially unfreed. The vulnerability is addressed by f...

EUVD-2026-55588

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: bound element ID read when checking non-inheritance cfg80211iselementinherited reads the first data octet of the candidate element id = elem-data0 to look it up in an extension non-inheritance list. It does so aft...

CVE-2026-68352 wifi: ath6kl: fix OOB read from firmware IE lengths in connect event

In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix OOB read from firmware IE lengths in connect event The firmware-controlled beaconielen, assocreqlen, and assocresplen fields in ath6klwmiconnecteventrx are not validated against the buffer length. Their sum up t...

EUVD-2026-55412

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: guard link STA in decap offload mt7925stasetdecapoffload iterates over the vif validlinks mask when updating decap offload state for an MLO station. The station may not have a link STA for every valid link of...

CVE-2026-68309 wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: connac: fix possible NULL-pointer deref in mt76connacmcuunibsshetlv mt76connacgethephycap routine can theoretically return NULL so check cap pointer before dereferencing it...

CVE-2026-68308 wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: check pointer returned by mt76connacgethephycap mt76connacgethephycap routine can theoretically return NULL so check cap pointer before dereferencing it...

CVE-2026-66409

DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks. The password may be analyzed and obtained to connect to the access point of an affected robot...

EUVD-2026-55116

DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks. The password may be analyzed and obtained to connect to the access point of an affected robot...

CVE-2026-66409

DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks. The password may be analyzed and obtained to connect to the access point of an affected robot...

CVE-2026-66409

CVE-2026-66409 affects DEEBOT PRO M1 and DEEBOT PRO K1VAC. The issue is a weak password on the devices’ Wi‑Fi hotspot, which could allow an attacker to obtain the hotspot password and connect to the robot’s access point. The JVN entry confirms this weakness (CWE-1391) and the broader set of issue...

PT-2026-69709

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL-pointer dereference issue exists in the mt76 connac mcu uni bss he tlv function. This occurs because the mt76 connac get he phy cap routine can return a NULL value, which is then...

PT-2026-69710

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mt7915 wireless driver where the functions mt7915 mcu bss he tlv and mt7915 mcu sta bfer tlv dereference the HE PHY capability returned by mt76 connac get he phy...

Linux Distros Unpatched Vulnerability : CVE-2026-68412

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: cfg80211: Fix an error handling path in cfg80211wextsiwscan If the test against IEEE80211MAXSSIDLEN fails, then 'creq' leaks. Use the existing error...

PT-2026-69773

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read occurs during scanning when the device delivers a truncated beacon or probe response frame. The at76 guess freq function only verifies that the received frame is at...

PT-2026-69595

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mt7615 wireless driver where PKT TYPE TXRX NOTIFY events, which are intended only for mmio buses, are dispatched to mt7615 mac tx free across all bus types. This...

Linux Distros Unpatched Vulnerability : CVE-2026-68192

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: brcmfmac: make releasescratchbuffers idempotent brcmfpciereleasescratchbuffers frees the shared.scratch and shared.ringupd DMA buffers with dmafreecoheren...

Linux Distros Unpatched Vulnerability : CVE-2026-68405

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mac80211: free APVLAN bcbuf SKBs outside IRQ lock ieee80211dostop removes APVLAN packets from the parent AP ps-bcbuf while holding ps-bcbuf.lock with IRQs...

Linux Distros Unpatched Vulnerability : CVE-2026-68404

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: cfg80211: use wiphy work for socket owner autodisconnect nl80211netlinknotify walks the cfg80211 wireless device list when a NETLINKGENERIC socket is...

Linux Distros Unpatched Vulnerability : CVE-2026-68197

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper mwifiextdlsaddhtoper gates its follow-the-AP-bandwidth path on bssdesc-bcnhtcap being...