112 matches found
EUVD-2026-82027
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV When a CSA countdown is active, mt7996mcubeaconcntdwn emits two bssbcncntdwntlv entries the CSA countdown and the CCA-abort BCC, but MT7996BEACONUPDATESIZE only...
CVE-2026-90366
This Linux kernel vulnerability affects the mt76/mt7996 WiFi driver (MediaTek). The function mt7996_mcu_beacon_cntdwn() emits two bss_bcn_cntdwn_tlv entries (CSA countdown and CCA-abort BCC), but MT7996_BEACON_UPDATE_SIZE only reserved space for one. With MBSSID enabled and a near-maximum beacon ...
CVE-2021-1965
CVE-2021-1965 CVE-2021-1965 WiFi Zero Click RCE 触发 PoC 这是一个快速且粗糙的 Proof-of-Concept 代码，用于验证你的手机是否存在漏洞。运行该 PoC 代码后，你的手机预计会在几秒钟内崩溃并重启。如果你需要更多关于该漏洞及易受攻击代码的信息，请参阅以下内容： 描述：在 MBSSID 扫描 IE 解析期间，由于参数长度检查缺失，可能导致缓冲区溢出 在多次 BSSID 扫描 IE 解析期间，会在 newie 变量上分配大小为 1024 的内存，如果 IE 长度大于 1024，则可能在 utilgennewie 中造成缓冲区溢出...
Astra Linux – Vulnerability in Linux 6.1
In the Linux kernel, the following vulnerability has been resolved: Wifi: nl80211: Fixed an integer overflow in nl80211ParseMBSSIDElems. The nl80211ParseMBSSIDElems function uses a u8 variable numElems to count the number of MBSSID elements in the nested netlink attribute attrs. This can lead to ...
CVE-2026-68472
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate EHT MLE before MLD ID read cfg80211gennewie copies ML probe response elements from the parent frame when the parent EHT multi-link element has an MLD ID matching the nontransmitted BSSID index. The code...
CVE-2026-68472
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate EHT MLE before MLD ID read cfg80211gennewie copies ML probe response elements from the parent frame when the parent EHT multi-link element has an MLD ID matching the nontransmitted BSSID index. The code...
UBUNTU-CVE-2026-68472
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate EHT MLE before MLD ID read cfg80211gennewie copies ML probe response elements from the parent frame when the parent EHT multi-link element has an MLD ID matching the nontransmitted BSSID index. The code...
EUVD-2026-59094
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate EHT MLE before MLD ID read cfg80211gennewie copies ML probe response elements from the parent frame when the parent EHT multi-link element has an MLD ID matching the nontransmitted BSSID index. The code...
CVE-2026-68472 wifi: cfg80211: validate EHT MLE before MLD ID read
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate EHT MLE before MLD ID read cfg80211gennewie copies ML probe response elements from the parent frame when the parent EHT multi-link element has an MLD ID matching the nontransmitted BSSID index. The code...
SUSE CVE-2026-68407
In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: free RNR data on MBSSID mismatch nl80211parsebeacon rejects EMA RNR data when there are fewer RNR entries than MBSSID entries. The rejected RNR allocation has not been attached to the beacon data yet, so free it...
CVE-2026-68407
A flaw was found in the Linux kernel's Wi-Fi subsystem nl80211. When processing beacon frames, the nl80211parsebeacon function may fail to properly free allocated RNR Reduced Neighbor Report data if there is a mismatch in the number of RNR and MBSSID Multiple Basic Service Set Identifier entries...
CVE-2026-68407
In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: free RNR data on MBSSID mismatch nl80211parsebeacon rejects EMA RNR data when there are fewer RNR entries than MBSSID entries. The rejected RNR allocation has not been attached to the beacon data yet, so free it...
UBUNTU-CVE-2026-68407
In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: free RNR data on MBSSID mismatch nl80211parsebeacon rejects EMA RNR data when there are fewer RNR entries than MBSSID entries. The rejected RNR allocation has not been attached to the beacon data yet, so free it...
CVE-2026-68407
In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: free RNR data on MBSSID mismatch nl80211parsebeacon rejects EMA RNR data when there are fewer RNR entries than MBSSID entries. The rejected RNR allocation has not been attached to the beacon data yet, so free it...
EUVD-2026-55593
In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: free RNR data on MBSSID mismatch nl80211parsebeacon rejects EMA RNR data when there are fewer RNR entries than MBSSID entries. The rejected RNR allocation has not been attached to the beacon data yet, so free it...
CVE-2026-68407 wifi: nl80211: free RNR data on MBSSID mismatch
In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: free RNR data on MBSSID mismatch nl80211parsebeacon rejects EMA RNR data when there are fewer RNR entries than MBSSID entries. The rejected RNR allocation has not been attached to the beacon data yet, so free it...
CVE-2026-64174
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: advance loop vars in cfg80211mergeprofile cfg80211mergeprofile reassembles a Multi-BSSID non-transmitted BSS profile that has been split across multiple consecutive MBSSID elements. Its while-loop calls...
CVE-2026-64174 wifi: cfg80211: advance loop vars in cfg80211_merge_profile()
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: advance loop vars in cfg80211mergeprofile cfg80211mergeprofile reassembles a Multi-BSSID non-transmitted BSS profile that has been split across multiple consecutive MBSSID elements. Its while-loop calls...
CVE-2026-64174
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: advance loop vars in cfg80211mergeprofile cfg80211mergeprofile reassembles a Multi-BSSID non-transmitted BSS profile that has been split across multiple consecutive MBSSID elements. Its while-loop calls...