CVE-2026-23246

CVE-2026-23246 affects the Linux kernel wifi mac80211 bounds-check in the ML Reconfiguration path. The issue arises from linking link_id (0-15) to the link_removal_timeout array (size 15), allowing an out-of-bounds write when link_id equals 15. The advisories state to skip subelements with link_i...

PT-2026-26049

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bounds-check link id in ieee80211 ml reconfiguration link id is taken from the ML Reconfiguration element control & 0x000f, so it can be 0..15. link removal timeout has IEEE80211 MLD MAX NUM LINKS 15 elements, so...