UBUNTU-CVE-2026-72004

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix memory leak in ieee80211registerhw If kmemdup fails while copying supported band structures, the error path jumps to failrate. This skips ratecontroldeinitialize and leaks the initialized local-ratectrl. Fix...

CVE-2026-68470

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate extension-frame layout before RX Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can still reach helpers and interface dispatch code that read...

UBUNTU-CVE-2026-68470

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate extension-frame layout before RX Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can still reach helpers and interface dispatch code that read...

CVE-2026-74366 wifi: ath12k: fix NULL deref in change_sta_links for unready link

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix NULL deref in changestalinks for unready link ieee80211setactivelinks calls ieee80211linkusechannel for each newly-added link and WARNONONCEs if it fails. The call uses assignonfailure=true, which allows mac8021...

CVE-2026-74366 wifi: ath12k: fix NULL deref in change_sta_links for unready link

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix NULL deref in changestalinks for unready link ieee80211setactivelinks calls ieee80211linkusechannel for each newly-added link and WARNONONCEs if it fails. The call uses assignonfailure=true, which allows mac8021...

CVE-2026-74366

CVE-2026-74366 concerns a NULL dereference in the Linux kernel’s ath12k wifi driver when handling unready links. The issue occurs because a path that validates a MAC channel may not create the vdev, leaving arvif->is_created as false and arvif->ar NULL. Subsequent code paths allocate an ars...

CVE-2026-74336 wifi: mac80211: bound S1G TIM PVB walk to the TIM element

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bound S1G TIM PVB walk to the TIM element ieee80211s1gchecktim parses the S1G Partial Virtual Bitmap PVB of a received TIM element. The TIM is handed in as the element payload: ieee80211parseelemsfull stores...

EUVD-2026-59483

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bound S1G TIM PVB walk to the TIM element ieee80211s1gchecktim parses the S1G Partial Virtual Bitmap PVB of a received TIM element. The TIM is handed in as the element payload: ieee80211parseelemsfull stores...

CVE-2026-74336

CVE-2026-74336 concerns the Linux kernel’s wifi/mac80211 code. The vulnerability arises in ieee80211_s1g_check_tim() when parsing the S1G TIM PVB, where the end boundary used for walking encoded blocks was incorrectly computed as tim_len + 2, allowing a read past the TIM element into adjacent dat...

CVE-2026-74336 wifi: mac80211: bound S1G TIM PVB walk to the TIM element

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bound S1G TIM PVB walk to the TIM element ieee80211s1gchecktim parses the S1G Partial Virtual Bitmap PVB of a received TIM element. The TIM is handed in as the element payload: ieee80211parseelemsfull stores...

EUVD-2026-59469

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix possible NULL pointer dereference in mt7996macwritetxwi80211 For injected frames e.g. via radiotap, mac80211 can pass info-control.vif = NULL, as explicitly noted in struct ieee80211txinfo. Check vif point...

CVE-2026-74322

In the Linux kernel, the wifi/mt76 mt7996 path is affected by CVE-2026-74322. The vulnerability stems from a possible NULL pointer dereference in mt7996_mac_write_txwi_80211() when handling injected frames (e.g., radiotap) where info->control.vif can be NULL. The code originally calls ieee8021...

CVE-2026-72004 wifi: mac80211: fix memory leak in ieee80211_register_hw()

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix memory leak in ieee80211registerhw If kmemdup fails while copying supported band structures, the error path jumps to failrate. This skips ratecontroldeinitialize and leaks the initialized local-ratectrl. Fix...

EUVD-2026-59103

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix memory leak in ieee80211registerhw If kmemdup fails while copying supported band structures, the error path jumps to failrate. This skips ratecontroldeinitialize and leaks the initialized local-ratectrl. Fix...

CVE-2026-72004 wifi: mac80211: fix memory leak in ieee80211_register_hw()

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix memory leak in ieee80211registerhw If kmemdup fails while copying supported band structures, the error path jumps to failrate. This skips ratecontroldeinitialize and leaks the initialized local-ratectrl. Fix...

CVE-2026-72004

CVE-2026-72004 — Linux kernel (wifi/mac80211) memory leak : In ieee80211_register_hw(), if kmemdup() fails while copying supported band structures, the error path jumps to fail_rate, skipping rate_control_deinitialize() and leaking the initialized local->rate_ctrl. The fix introduces a fail_ba...

CVE-2026-68470 wifi: mac80211: validate extension-frame layout before RX

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate extension-frame layout before RX Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can still reach helpers and interface dispatch code that read...

CVE-2026-68470 wifi: mac80211: validate extension-frame layout before RX

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate extension-frame layout before RX Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can still reach helpers and interface dispatch code that read...

EUVD-2026-59092

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate extension-frame layout before RX Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can still reach helpers and interface dispatch code that read...

CVE-2026-68470

The CVE-2026-68470 vulnerability affects the Linux kernel’s wifi/mac80211 path. It occurs when validating extension-frame layout before RX, allowing extension subtypes beyond S1G beacons to reach regular-header RX processing and potentially read header addresses. The fix narrows RX routing to han...