CVE-2021-1965

CVE-2021-1965 CVE-2021-1965 WiFi Zero Click RCE 触发 PoC 这是一个快速且粗糙的 Proof-of-Concept 代码，用于验证你的手机是否存在漏洞。运行该 PoC 代码后，你的手机预计会在几秒钟内崩溃并重启。如果你需要更多关于该漏洞及易受攻击代码的信息，请参阅以下内容： 描述：在 MBSSID 扫描 IE 解析期间，由于参数长度检查缺失，可能导致缓冲区溢出 在多次 BSSID 扫描 IE 解析期间，会在 newie 变量上分配大小为 1024 的内存，如果 IE 长度大于 1024，则可能在 utilgennewie 中造成缓冲区溢出...

AZL-102923 CVE-2026-90366 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV When a CSA countdown is active, mt7996mcubeaconcntdwn emits two bssbcncntdwntlv entries the CSA countdown and the CCA-abort BCC, but MT7996BEACONUPDATESIZE only...

CVE-2026-90366 wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV When a CSA countdown is active, mt7996mcubeaconcntdwn emits two bssbcncntdwntlv entries the CSA countdown and the CCA-abort BCC, but MT7996BEACONUPDATESIZE only...

EUVD-2026-82027

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV When a CSA countdown is active, mt7996mcubeaconcntdwn emits two bssbcncntdwntlv entries the CSA countdown and the CCA-abort BCC, but MT7996BEACONUPDATESIZE only...

CVE-2026-90366

This Linux kernel vulnerability affects the mt76/mt7996 WiFi driver (MediaTek). The function mt7996_mcu_beacon_cntdwn() emits two bss_bcn_cntdwn_tlv entries (CSA countdown and CCA-abort BCC), but MT7996_BEACON_UPDATE_SIZE only reserved space for one. With MBSSID enabled and a near-maximum beacon ...

SUSE CVE-2026-68472

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate EHT MLE before MLD ID read cfg80211gennewie copies ML probe response elements from the parent frame when the parent EHT multi-link element has an MLD ID matching the nontransmitted BSSID index. The code...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Wifi: nl80211: Fixed an integer overflow in nl80211ParseMBSSIDElems. The nl80211ParseMBSSIDElems function uses a u8 variable numElems to count the number of MBSSID elements in the nested netlink attribute attrs. This can lead to ...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: Wifi: cfg80211: Validate EHT MLE before reading the MLD ID The cfg80211gennewie function copies the ML probe response elements from the parent frame when the parent EHT multi-link element has an MLD ID that matches the...

CVE-2026-68472

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate EHT MLE before MLD ID read cfg80211gennewie copies ML probe response elements from the parent frame when the parent EHT multi-link element has an MLD ID matching the nontransmitted BSSID index. The code...

UBUNTU-CVE-2026-68472

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate EHT MLE before MLD ID read cfg80211gennewie copies ML probe response elements from the parent frame when the parent EHT multi-link element has an MLD ID matching the nontransmitted BSSID index. The code...

CVE-2026-68472

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate EHT MLE before MLD ID read cfg80211gennewie copies ML probe response elements from the parent frame when the parent EHT multi-link element has an MLD ID matching the nontransmitted BSSID index. The code...

CVE-2026-68472 wifi: cfg80211: validate EHT MLE before MLD ID read

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate EHT MLE before MLD ID read cfg80211gennewie copies ML probe response elements from the parent frame when the parent EHT multi-link element has an MLD ID matching the nontransmitted BSSID index. The code...

EUVD-2026-59094

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate EHT MLE before MLD ID read cfg80211gennewie copies ML probe response elements from the parent frame when the parent EHT multi-link element has an MLD ID matching the nontransmitted BSSID index. The code...

CVE-2026-68472: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate EHT MLE before MLD ID read cfg80211gennewie copies ML probe response elements from the parent frame when the parent EHT multi-link element has an MLD ID matching the nontransmitted BSSID index. The code...

SUSE CVE-2026-68407

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: free RNR data on MBSSID mismatch nl80211parsebeacon rejects EMA RNR data when there are fewer RNR entries than MBSSID entries. The rejected RNR allocation has not been attached to the beacon data yet, so free it...

CVE-2026-68407

A flaw was found in the Linux kernel's Wi-Fi subsystem nl80211. When processing beacon frames, the nl80211parsebeacon function may fail to properly free allocated RNR Reduced Neighbor Report data if there is a mismatch in the number of RNR and MBSSID Multiple Basic Service Set Identifier entries...

wifi: nl80211: free RNR data on MBSSID mismatch

...

CVE-2026-68407

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: free RNR data on MBSSID mismatch nl80211parsebeacon rejects EMA RNR data when there are fewer RNR entries than MBSSID entries. The rejected RNR allocation has not been attached to the beacon data yet, so free it...

UBUNTU-CVE-2026-68407

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: free RNR data on MBSSID mismatch nl80211parsebeacon rejects EMA RNR data when there are fewer RNR entries than MBSSID entries. The rejected RNR allocation has not been attached to the beacon data yet, so free it...

CVE-2026-68407

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: free RNR data on MBSSID mismatch nl80211parsebeacon rejects EMA RNR data when there are fewer RNR entries than MBSSID entries. The rejected RNR allocation has not been attached to the beacon data yet, so free it...