26 matches found
CVE-2026-93805 wifi: cfg80211: validate rx/tx MLME callback frame lengths before access
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate rx/tx MLME callback frame lengths before access cfg80211rxmlmemgmt and cfg80211txmlmemgmt call tracepoints before rejecting frames shorter than the frame-control field. After that, they only require len =...
CVE-2026-93805 wifi: cfg80211: validate rx/tx MLME callback frame lengths before access
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate rx/tx MLME callback frame lengths before access cfg80211rxmlmemgmt and cfg80211txmlmemgmt call tracepoints before rejecting frames shorter than the frame-control field. After that, they only require len =...
PT-2026-98005
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read issue exists in the wifi cfg80211 component. The functions cfg80211 rx mlme mgmt and cfg80211 tx mlme mgmt fail to properly validate the length of frames relative t...
PT-2026-104864
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate rx/tx MLME callback frame lengths before access cfg80211 rx mlme mgmt and cfg80211 tx mlme mgmt call tracepoints before rejecting frames shorter than the frame-control field. After that, they only require...
mac80211 Stack Use-After-Free
The vulnerability of the ieee80211mlepcs function in the net/mac80211/mlme.c module of the mac80211 stack in the Linux operating system is related to the pointer manipulation. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality, integrity, and accessibili...
Linux mac80211 Stack Buffer Overflow DoS
The vulnerability of the function ieee80211determinechanmode in the module net/mac80211/mlme.c of the Linux kernel’s mac80211 stack is related to the return of incorrect code states. Exploiting this vulnerability could allow an attacker to cause a service failure...
CVE-2026-68471
A flaw was found in the Wi-Fi IEEE 802.11 component of the Linux kernel. The ieee80211mlecommonsize function uses the first common-info octet as the length for all known MLE Management Link Establishment types. However, the ieee80211mlesizeok function did not properly validate this length for all...
Linux net mac80211 mlme Heap Buffer Overflow DoS
The vulnerability of the function ieee80211mlreconfiguration in the net/mac80211/mlme.c module of the Linux operating system is related to the occurrence of operations outside the buffer in memory. Exploiting this vulnerability could allow a remote attacker to compromise the integrity of protecte...
CVE-2026-68471 wifi: ieee80211: validate MLE common info length
In the Linux kernel, the following vulnerability has been resolved: wifi: ieee80211: validate MLE common info length ieee80211mlecommonsize uses the first common-info octet as the common information length for all known MLE types. However, ieee80211mlesizeok only validates that octet for Basic,...
CVE-2026-53178
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: rtwmlme: add bounds checks before ielength subtraction Add guards to ensure ielength is large enough before subtracting fixed IE offsets to prevent unsigned integer underflow...
CVE-2026-53178 staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: rtwmlme: add bounds checks before ielength subtraction Add guards to ensure ielength is large enough before subtracting fixed IE offsets to prevent unsigned integer underflow...
CVE-2026-53178 staging: rtl8723bs: rtw_mlme: add bounds checks before ie_length subtraction
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: rtwmlme: add bounds checks before ielength subtraction Add guards to ensure ielength is large enough before subtracting fixed IE offsets to prevent unsigned integer underflow...
CVE-2026-53178
CVE-2026-53178 is a Linux kernel issue in the rtl8723bs Wi‑Fi driver (rtw_mlme) where an unsigned underflow can occur when subtracting fixed IE offsets from ie_length. The available connected sources indicate the bug has been fixed in the kernel (staging) by adding bounds checks to ensure ie_leng...
EUVD-2026-39269
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: rtwmlme: add bounds checks before ielength subtraction Add guards to ensure ielength is large enough before subtracting fixed IE offsets to prevent unsigned integer underflow...
Linux kernel MLME DoS
The vulnerability in the net/wireless/mlme.c module of Linux operating systems is related to insufficient input data validation. Exploiting this vulnerability can allow attackers to cause service failures...
Linux Distros Unpatched Vulnerability : CVE-2022-50533
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: mlme: fix null-ptr deref on failed assoc If association to an AP without a...
UBUNTU-CVE-2022-50533
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: mlme: fix null-ptr deref on failed assoc If association to an AP without a link 0 fails, then we crash in tracing because it assumes that either apmldaddr or link 0 BSS is valid, since we clear sdata-vif.validlink...
CVE-2022-50533
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: mlme: fix null-ptr deref on failed assoc If association to an AP without a link 0 fails, then we crash in tracing because it assumes that either apmldaddr or link 0 BSS is valid, since we clear sdata-vif.validlink...
SUSE CVE-2015-4142
Integer underflow in the WMM Action frame parser in hostapd 0.5.5 through 2.4 and wpasupplicant 0.7.0 through 2.4, when used for AP mode MLME/SME functionality, allows remote attackers to cause a denial of service crash via a crafted frame, which triggers an out-of-bounds read...
GSD-2023-1000806 wifi: mac80211: mlme: fix null-ptr deref on failed assoc
wifi: mac80211: mlme: fix null-ptr deref on failed assoc This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v6.0.16 by commit...