# CVE-2026-64117: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb

> A use-after-free vulnerability in the Linux kernel's mac80211 subsystem allows attackers to cause a denial of service or potentially execute code via crafted Wi-Fi mesh traffic.

- **Severity:** High 8.8 (`CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 19 Jul 2026
- **Updated:** 21 Oct 2026
- **Also known as:** AZL-92754, BELL-CVE-2026-64117, DEBIAN-CVE-2026-64117, GHSA-8c2f-6crq-prr9, ROOT-OS-DEBIAN-13-CVE-2026-64117, UBUNTU-CVE-2026-64117

## What is CVE-2026-64117?

CVE-2026-64117 is a high-severity use after free vulnerability in Linux kernel, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb

ieee80211_invoke_fast_rx() reads RX status through
IEEE80211_SKB_RXCB(skb), which aliases the same skb->cb storage
that ieee80211_rx_mesh_data() reuses as IEEE80211_TX_INFO.  In the
unicast forward path, mesh_data does:

	info = IEEE80211_SKB_CB(fwd_skb);
	memset(info, 0, sizeof(*info));

on the same skb the caller still names via rx->skb, then either
queues the skb for TX (success) or kfree_skb()'s it (no-route)
before returning RX_QUEUED.  The caller's RX_QUEUED arm then
calls sta_stats_encode_rate(status) on memory that is either
zeroed (success path) or freed (no-route path).  The latter is
KASAN slab-use-after-free in ieee80211_prepare_and_rx_handle.

Fix by encoding the rate from status before invoking
ieee80211_rx_mesh_data(), so the RX_QUEUED arm consumes a value
captured while status was still backed by valid memory.

Weakness: CWE-416 (Use After Free)

## Which versions are affected by CVE-2026-64117?

It affects 1 product.


Products: Linux kernel.

## How do I fix CVE-2026-64117?

Apply the vendor's patch.

## Is CVE-2026-64117 being exploited?

There is no known exploitation of CVE-2026-64117 in the wild and no public exploit code.

## Other vulnerabilities in Linux kernel

- [CVE-2026-53266](https://insights.sbomify.com/CVE-2026-53266/): Linux Kernel Out-of-Bounds Write (high 8.8, exploited in the wild)
- [CVE-2013-6282](https://insights.sbomify.com/CVE-2013-6282/): Linux Kernel Improper Input Validation (high 8.8, exploited in the wild)
- [CVE-2022-0185](https://insights.sbomify.com/CVE-2022-0185/): Linux Kernel Heap-Based Buffer Overflow (high 8.4, exploited in the wild)
- [CVE-2013-2094](https://insights.sbomify.com/CVE-2013-2094/): Linux Kernel Privilege Escalation (high 8.4, exploited in the wild)
- [CVE-2026-53362](https://insights.sbomify.com/CVE-2026-53362/): Linux Kernel Unspecified (high 7.8, exploited in the wild)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-64117 and fix it if it is affected.

What it is: CVE-2026-64117 is a high-severity use after free vulnerability in Linux kernel, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-64117 in the wild and no public exploit code.

Affected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-64117/ (Markdown: https://insights.sbomify.com/CVE-2026-64117/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-64117
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-64117
- OSV: https://osv.dev/vulnerability/CVE-2026-64117

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-64117/
Summaries are generated and may contain mistakes; the official description above is the record.