CVE-2025-36939

Multiple vulnerabilities exist in OpenThread's handling of MLE packets. An authenticated attacker on the same Thread network could send specially crafted packets to cause a denial of service. These issues include triggerable assertion failures and a stack-based buffer overflow...

CVE-2025-36939

Multiple vulnerabilities exist in OpenThread 's handling of MLE (Mesh Link Establishment) packets . An authenticated attacker on the same Thread network can send specially crafted packets to trigger assertion failures and a stack-based buffer overflow , resulting in a denial of service . The CNA-...

EUVD-2025-210766

Multiple vulnerabilities exist in OpenThread's handling of MLE packets. An authenticated attacker on the same Thread network could send specially crafted packets to cause a denial of service. These issues include triggerable assertion failures and a stack-based buffer overflow...

CVE-2025-36939

Multiple vulnerabilities exist in OpenThread's handling of MLE packets. An authenticated attacker on the same Thread network could send specially crafted packets to cause a denial of service. These issues include triggerable assertion failures and a stack-based buffer overflow...

PT-2026-80924

Multiple vulnerabilities exist in OpenThread's handling of MLE packets. An authenticated attacker on the same Thread network could send specially crafted packets to cause a denial of service. These issues include triggerable assertion failures and a stack-based buffer overflow...

Linux Distros Unpatched Vulnerability : CVE-2026-68472

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: cfg80211: validate EHT MLE before MLD ID read cfg80211gennewie copies ML probe response elements from the parent frame when the parent EHT multi-link...

CVE-2026-68472

A flaw was found in the Linux kernel's cfg80211 Wi-Fi subsystem. A remote attacker, by operating a malicious Access Point AP, could send a specially crafted EHT Multi-Link Element MLE in an MBSSID beacon. This could cause the kernel to read beyond the intended memory boundary when processing the...

CVE-2026-68471

In the Linux kernel, the following vulnerability has been resolved: wifi: ieee80211: validate MLE common info length ieee80211mlecommonsize uses the first common-info octet as the common information length for all known MLE types. However, ieee80211mlesizeok only validates that octet for Basic,...

CVE-2026-68472

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate EHT MLE before MLD ID read cfg80211gennewie copies ML probe response elements from the parent frame when the parent EHT multi-link element has an MLD ID matching the nontransmitted BSSID index. The code...

UBUNTU-CVE-2026-68472

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate EHT MLE before MLD ID read cfg80211gennewie copies ML probe response elements from the parent frame when the parent EHT multi-link element has an MLD ID matching the nontransmitted BSSID index. The code...

UBUNTU-CVE-2026-68471

In the Linux kernel, the following vulnerability has been resolved: wifi: ieee80211: validate MLE common info length ieee80211mlecommonsize uses the first common-info octet as the common information length for all known MLE types. However, ieee80211mlesizeok only validates that octet for Basic,...

EUVD-2026-59094

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate EHT MLE before MLD ID read cfg80211gennewie copies ML probe response elements from the parent frame when the parent EHT multi-link element has an MLD ID matching the nontransmitted BSSID index. The code...

CVE-2026-68472 wifi: cfg80211: validate EHT MLE before MLD ID read

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate EHT MLE before MLD ID read cfg80211gennewie copies ML probe response elements from the parent frame when the parent EHT multi-link element has an MLD ID matching the nontransmitted BSSID index. The code...

CVE-2026-68471

The CVE-2026-68471 entry describes a Linux kernel Wi-Fi (ieee80211) vulnerability in MLE length validation. The root cause is that ieee80211_mle_common_size() used the first common-info octet as the length for all MLE types, while ieee80211_mle_size_ok() only validated that octet for Basic, Probe...

CVE-2026-68472

In CVE-2026-68472, Linux kernel code path for wifi cfg80211 is vulnerable when processing MBSSID EHT MLE data. The issue arises in cfg80211_gen_new_ie() which copies ML probe response elements from the parent frame and may read beyond the IE boundary to obtain the MLD ID via ieee80211_mle_get_mld...

CVE-2026-68472 wifi: cfg80211: validate EHT MLE before MLD ID read

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate EHT MLE before MLD ID read cfg80211gennewie copies ML probe response elements from the parent frame when the parent EHT multi-link element has an MLD ID matching the nontransmitted BSSID index. The code...

EUVD-2026-59093

In the Linux kernel, the following vulnerability has been resolved: wifi: ieee80211: validate MLE common info length ieee80211mlecommonsize uses the first common-info octet as the common information length for all known MLE types. However, ieee80211mlesizeok only validates that octet for Basic,...

PT-2026-72184

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate EHT MLE before MLD ID read cfg80211 gen new ie copies ML probe response elements from the parent frame when the parent EHT multi-link element has an MLD ID matching the nontransmitted BSSID index. The cod...

PT-2026-72183

In the Linux kernel, the following vulnerability has been resolved: wifi: ieee80211: validate MLE common info length ieee80211 mle common size uses the first common-info octet as the common information length for all known MLE types. However, ieee80211 mle size ok only validates that octet for...

CVE-2026-64515

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix MLE defragmentation If either reconf or EPCS multi-link element MLE is contained in a non-transmitted profile, the defragmentation routine is called with a pointer to the defragmented copy, but the original...