CVE-2026-64223
CVE CVE-2026-64223EUVD EUVD-2026-48631Published 2026-07-24T15:23:08.000ZLast changed 2026-08-05T12:40:10.000ZCVSS 8.1
What the advisory describes
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: consume only present negotiated TTLM maps ieee80211_tid_to_link_map_size_ok() validates negotiated TTLM elements against the number of link-map entries indicated by link_map_presence. ieee80211_parse_neg_ttlm() must consume the same layout. The parser advanced its cursor for every TID, including TIDs whose presence bit is clear and therefore have no map bytes in the element. A sparse map can then make a later present TID read past the validated element. The bad bytes land in neg_ttlm->{up,down}link[tid] but are gated by valid_links before being applied to driver state, so a peer cannot turn the read into a policy change. Under KUnit + KASAN with an exact-sized element allocation the OOB read is reported as a slab-out-of-bounds; whether the same trigger fires under the production RX path depends on surrounding allocator state. Advance the cursor only when the current TID has a map present.
Source: EUVD (ENISA), in the words of the advisory.
Products the advisory names
These come from the advisory itself, not from any check we performed.
- Linux — Linux 8f500fbc6c655976c8062b1f1e55bd0b3095d6c2 <a6e6ccd5bd07155c2add6c74ce1a5e68ad3b95ea; 8f500fbc6c655976c8062b1f1e55bd0b3095d6c2 <2becaaeebe230ade1fcd5d0f1cde4d6ee93ec78f; 8f500fbc6c655976c8062b1f1e55bd0b3095d6c2 <2dd9304727c7041df0a599595910bdbe02ad03c5; patch: 6.18.34; 8f500fbc6c655976c8062b1f1e55bd0b3095d6c2 <f7d395dc5008168ac5b9c1ac2791e59a6078cca1; 6.9; patch: 6.12.92; patch: 0; patch: 7.1; patch: 7.0.11
The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.
Carried in the product catalogue
An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.
- Linux — Linux
Does this concern one of your customers?
This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.
Try it for 28 daysPatchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.