{"api_version":"1","generated_at":"2026-08-14T13:36:38+00:00","cve":"CVE-2026-68402","urls":{"html":"https://cve.report/CVE-2026-68402","api":"https://cve.report/api/cve/CVE-2026-68402.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-68402","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-68402"},"summary":{"title":"wifi: cfg80211: bound element ID read when checking non-inheritance","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: bound element ID read when checking non-inheritance\n\ncfg80211_is_element_inherited() reads the first data octet of the\ncandidate element (id = elem->data[0]) to look it up in an extension\nnon-inheritance list. It does so after testing elem->id, but without\nverifying that the element actually has a data octet. A zero-length\nextension element (WLAN_EID_EXTENSION with length 0) therefore makes it\nread one octet past the end of the element.\n\n_ieee802_11_parse_elems_full() runs this check for every element of a\nframe once a non-inheritance context exists -- e.g. while parsing a\nper-STA profile of a Multi-Link element in a (re)association response,\nor a non-transmitted BSS profile -- so a crafted frame from an AP can\ntrigger a one-octet slab-out-of-bounds read during element parsing:\n\n  BUG: KASAN: slab-out-of-bounds in cfg80211_is_element_inherited\n  Read of size 1 ... in net/wireless/scan.c\n\nReturn early (treat the element as inherited) when an extension element\ncarries no data, mirroring the existing handling of empty ID lists.\n\nThe bug was found by fuzzing ieee802_11_parse_elems_full() under KASAN.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-10 13:20:33","updated_at":"2026-08-13 23:17:35"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.1","severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.1","severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","data":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/20c308d9a57722801961f816395bf825f7bde6bc","name":"https://git.kernel.org/stable/c/20c308d9a57722801961f816395bf825f7bde6bc","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/84bd907361c56fbd5523eceb2682cb39da059bd5","name":"https://git.kernel.org/stable/c/84bd907361c56fbd5523eceb2682cb39da059bd5","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/11ac7a5e75f5132f1778e0c60981d30dc29fb869","name":"https://git.kernel.org/stable/c/11ac7a5e75f5132f1778e0c60981d30dc29fb869","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/cb8afea4655ff004fa7feee825d5c79783525383","name":"https://git.kernel.org/stable/c/cb8afea4655ff004fa7feee825d5c79783525383","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/ddf2773bcc8e49a43c561f22ec1e7924215d7947","name":"https://git.kernel.org/stable/c/ddf2773bcc8e49a43c561f22ec1e7924215d7947","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-68402","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68402","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 20c308d9a57722801961f816395bf825f7bde6bc git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 84bd907361c56fbd5523eceb2682cb39da059bd5 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 11ac7a5e75f5132f1778e0c60981d30dc29fb869 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 ddf2773bcc8e49a43c561f22ec1e7924215d7947 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 cb8afea4655ff004fa7feee825d5c79783525383 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.2","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.2 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.148 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.101 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.42 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.6 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2-rc4 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"68402","cve":"CVE-2026-68402","epss":"0.001680000","percentile":"0.064110000","score_date":"2026-08-13","updated_at":"2026-08-14 00:07:35"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/wireless/scan.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"20c308d9a57722801961f816395bf825f7bde6bc","status":"affected","version":"f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3","versionType":"git"},{"lessThan":"84bd907361c56fbd5523eceb2682cb39da059bd5","status":"affected","version":"f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3","versionType":"git"},{"lessThan":"11ac7a5e75f5132f1778e0c60981d30dc29fb869","status":"affected","version":"f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3","versionType":"git"},{"lessThan":"ddf2773bcc8e49a43c561f22ec1e7924215d7947","status":"affected","version":"f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3","versionType":"git"},{"lessThan":"cb8afea4655ff004fa7feee825d5c79783525383","status":"affected","version":"f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/wireless/scan.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.2"},{"lessThan":"5.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.148","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.101","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.42","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2-rc4","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.148","versionStartIncluding":"5.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.101","versionStartIncluding":"5.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.42","versionStartIncluding":"5.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.6","versionStartIncluding":"5.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2-rc4","versionStartIncluding":"5.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: bound element ID read when checking non-inheritance\n\ncfg80211_is_element_inherited() reads the first data octet of the\ncandidate element (id = elem->data[0]) to look it up in an extension\nnon-inheritance list. It does so after testing elem->id, but without\nverifying that the element actually has a data octet. A zero-length\nextension element (WLAN_EID_EXTENSION with length 0) therefore makes it\nread one octet past the end of the element.\n\n_ieee802_11_parse_elems_full() runs this check for every element of a\nframe once a non-inheritance context exists -- e.g. while parsing a\nper-STA profile of a Multi-Link element in a (re)association response,\nor a non-transmitted BSS profile -- so a crafted frame from an AP can\ntrigger a one-octet slab-out-of-bounds read during element parsing:\n\n  BUG: KASAN: slab-out-of-bounds in cfg80211_is_element_inherited\n  Read of size 1 ... in net/wireless/scan.c\n\nReturn early (treat the element as inherited) when an extension element\ncarries no data, mirroring the existing handling of empty ID lists.\n\nThe bug was found by fuzzing ieee802_11_parse_elems_full() under KASAN."}],"metrics":[{"cvssV3_1":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:A - The malformed element arrives in an 802.11 management frame (beacon, probe response, ML probe response or (re)association response) processed by mac80211's element parser, so the attacker must be a rogue/spoofing AP within radio range of the victim station.\nAC:L - The attacker fully controls the frame contents and simply appends a zero-length WLAN_EID_EXTENSION element inside a frame that already establishes a non-inheritance context (multi-BSSID non-transmitted profile or a Multi-Link per-STA profile), which reliably triggers the over-read every time.\nPR:N - Beacons, probe responses and association responses are parsed before or independently of any authentication or key establishment, so an unauthenticated attacker with no credentials on the network can deliver the crafted frame.\nUI:N - Stations parse beacons and probe/association responses automatically as part of scanning, roaming and staying associated; no action by the device owner is needed for the crafted frame to be processed.\nS:U - The out-of-bounds read stays within the kernel's own memory and security authority; no other component or privilege domain is crossed.\nC:L - The read is a single octet past the end of the slab object, and its value is only compared against the non-inheritance ID list, influencing whether an element is parsed — this leaks at most a narrow side-channel oracle about one adjacent heap byte rather than arbitrary memory.\nI:N - The defect is purely a read; no kernel memory is written or corrupted, and the only consequence is a possibly wrong inherit/skip decision for one element in a frame the attacker already controls.\nA:H - The slab out-of-bounds access is fatal on KASAN, hardened or debug-allocator kernels (the bug was reported as a KASAN slab-out-of-bounds splat), and can be re-triggered at will by an adjacent unauthenticated attacker to repeatedly panic the machine."}]}],"providerMetadata":{"dateUpdated":"2026-08-13T22:44:38.055Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/20c308d9a57722801961f816395bf825f7bde6bc"},{"url":"https://git.kernel.org/stable/c/84bd907361c56fbd5523eceb2682cb39da059bd5"},{"url":"https://git.kernel.org/stable/c/11ac7a5e75f5132f1778e0c60981d30dc29fb869"},{"url":"https://git.kernel.org/stable/c/ddf2773bcc8e49a43c561f22ec1e7924215d7947"},{"url":"https://git.kernel.org/stable/c/cb8afea4655ff004fa7feee825d5c79783525383"}],"title":"wifi: cfg80211: bound element ID read when checking non-inheritance","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-68402","datePublished":"2026-08-10T12:04:22.113Z","dateReserved":"2026-07-30T09:28:09.389Z","dateUpdated":"2026-08-13T22:44:38.055Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-10 13:20:33","lastModifiedDate":"2026-08-13 23:17:35","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":4.2}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"68402","Ordinal":"1","Title":"wifi: cfg80211: bound element ID read when checking non-inherita","CVE":"CVE-2026-68402","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"68402","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: bound element ID read when checking non-inheritance\n\ncfg80211_is_element_inherited() reads the first data octet of the\ncandidate element (id = elem->data[0]) to look it up in an extension\nnon-inheritance list. It does so after testing elem->id, but without\nverifying that the element actually has a data octet. A zero-length\nextension element (WLAN_EID_EXTENSION with length 0) therefore makes it\nread one octet past the end of the element.\n\n_ieee802_11_parse_elems_full() runs this check for every element of a\nframe once a non-inheritance context exists -- e.g. while parsing a\nper-STA profile of a Multi-Link element in a (re)association response,\nor a non-transmitted BSS profile -- so a crafted frame from an AP can\ntrigger a one-octet slab-out-of-bounds read during element parsing:\n\n  BUG: KASAN: slab-out-of-bounds in cfg80211_is_element_inherited\n  Read of size 1 ... in net/wireless/scan.c\n\nReturn early (treat the element as inherited) when an extension element\ncarries no data, mirroring the existing handling of empty ID lists.\n\nThe bug was found by fuzzing ieee802_11_parse_elems_full() under KASAN.","Type":"Description","Title":"wifi: cfg80211: bound element ID read when checking non-inherita"}]}}}