CVE-2026-74554

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix out-of-bounds clearbit in ath12kmacdppeercleanup ath12kmacdppeercleanup clears the ML peer ID slot on the freemlpeeridmap bitmap by indexing it with dppeer-peerid. That is wrong: dppeer-peerid for an MLO peer...

CVE-2026-74408

The Linux kernel WiFi driver ath9k has a vulnerability (CVE-2026-74408) where ath_tx_edma_tasklet() accesses sc->tx.txq[ts.qid] with ts.qid being a 4-bit field (0-15) while the txq array supports only ATH9K_NUM_TX_QUEUES (10). A qid of 10 or higher causes an out-of-bounds access. The documente...

CVE-2026-74367 wifi: ath12k: fix inconsistent arvif state in vdev_create error paths

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix inconsistent arvif state in vdevcreate error paths ath12kmacvdevcreate has three error path issues that leave arvif in an inconsistent state: 1. When ath12kwmivdevcreate fails, the function returns directly...

CVE-2026-68349

In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: fix buffer overflow in rxstream failover path The failover continuation in carl9170rxstream copies the full tlen from the second USB transfer instead of capping at rxfailovermissing bytes. When both transfers are...

CVE-2026-68412 wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan()

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: Fix an error handling path in cfg80211wextsiwscan If the test against IEEE80211MAXSSIDLEN fails, then 'creq' leaks. Use the existing error handling path to fix it...

CVE-2026-68308 wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: check pointer returned by mt76connacgethephycap mt76connacgethephycap routine can theoretically return NULL so check cap pointer before dereferencing it...

CVE-2026-68195

The CVE describes a Linux kernel issue in the mt76/mt7615 wireless driver where PKT_TYPE_TXRX_NOTIFY is mmio-only but was dispatched on non-mmio buses, causing a NULL dereference when mt7615_mac_tx_free() calls tx_cleanup() with a NULL queue_ops->tx_cleanup(). The fix drops TXRX_NOTIFY on non-...

Linux Distros Unpatched Vulnerability : CVE-2026-68351

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read When the firmware sends a command response with a length mismatch, carl9170cmdcallback...

CVE-2026-64515

A flaw was found in the Linux kernel's mac80211 Wi-Fi subsystem. This vulnerability arises from incorrect handling of Multi-Link Element MLE defragmentation. When a reconf or EPCS Enhanced Power Save MLE is present in a non-transmitted profile, the defragmentation routine uses an incorrect pointe...

CVE-2026-64325

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon This patch is based on a BUG as reported by Bongani Hlope at https://lore.kernel.org/all/[email protected]/ When a channel-switch...

CVE-2026-64176

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices On old devices such as 7265D, rates are still encoded in version 1 format, which doesn't use the CCK/OFDM rate index 0-3/0-7 but rather their PLCP value e.g. 10 for 1 Mbp...

CVE-2026-53257

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: enforce HE/EHT cap/oper consistency Xiang Mei reports that mac80211 could crash if ehtcap is set but ehtoper isn't. Rather than fixing that for the individual users, enforce that both HE/EHT have consistent elemen...

CVE-2026-46136

A flaw was found in the Linux kernel's wifi: mt76: mt7921 component. A buffer length underflow in the CLC Country Logic Control mechanism can occur due to changes in the power table. This issue may lead to an almost infinite loop or an invalid power setting, resulting in a Denial of Service DoS b...

CVE-2026-46187

In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix kthread lifetime race between self-exit and external-stop RSI driver use both self-exitkthreadcompleteandexit and external-stop kthreadstop when killing a kthread. Generally, kthreadstop is called first, and in thi...

CVE-2026-43110

CVE-2026-43110 concerns the Linux kernel brcmfmac Wi‑Fi driver. The issue arises when processing firmware interface (IF) events: the code validates the firmware-provided interface index but still uses the raw bsscfgidx as an array index without a matching range check, enabling out-of-bounds acces...

CVE-2026-31552

CVE-2026-31552 affects the Linux kernel wlcore wifi path. A memory-allocation failure in wl1271_tx_allocate()/wl1271_prepare_tx_frame() could yield -EAGAIN and be misinterpreted by wlcore_tx_work_locked() as a full aggregation buffer, causing a retry loop under wl->mutex with GFP_ATOMIC. This ...

CVE-2026-23279

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix NULL pointer dereference in meshrxcsaframe In meshrxcsaframe, elems-meshchanswparamsie is dereferenced at lines 1638 and 1642 without a prior NULL check: ifmsh-chswttl = elems-meshchanswparamsie-meshttl;...

CVE-2025-71222

In the Linux kernel, the following vulnerability has been resolved: wifi: wlcore: ensure skb headroom before skbpush This avoids occasional skbunderpanic Oops from wl1271txwork. In this case, headroom is less than needed typically 110 - 94 = 16 bytes...

CVE-2026-23152 wifi: mac80211: correctly decode TTLM with default link map

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: correctly decode TTLM with default link map TID-To-Link Mapping TTLM elements do not contain any link mapping presence indicator if a default mapping is used and parsing needs to be skipped. Note that access point...

CVE-2026-23130 wifi: ath12k: fix dead lock while flushing management frames

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix dead lock while flushing management frames Commit 1 converted the management transmission work item into a wiphy work. Since a wiphy work can only run under wiphy lock protection, a race condition happens in bel...