CVE-2026-64223 wifi: mac80211: consume only present negotiated TTLM maps
A flaw in the Linux kernel Wi-Fi driver allows out-of-bounds reads when parsing sparse TTLM maps, potentially disclosing memory contents.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64223?
CVE-2026-64223 is a high-severity vulnerability in Linux kernel, published on 24 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: consume only present negotiated TTLM maps
ieee80211_tid_to_link_map_size_ok() validates negotiated TTLM elements against the number of link-map entries indicated by link_map_presence. ieee80211_parse_neg_ttlm() must consume the same layout.
The parser advanced its cursor for every TID, including TIDs whose presence bit is clear and therefore have no map bytes in the element. A sparse map can then make a later present TID read past the validated element.
The bad bytes land in neg_ttlm->{up,down}link[tid] but are gated by valid_links before being applied to driver state, so a peer cannot turn the read into a policy change. Under KUnit + KASAN with an exact-sized element allocation the OOB read is reported as a slab-out-of-bounds; whether the same trigger fires under the production RX path depends on surrounding allocator state.
Advance the cursor only when the current TID has a map present.
Weakness: CWE-125
Which versions are affected by CVE-2026-64223?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64223?
Apply the vendor's patch.
Is CVE-2026-64223 being exploited?
There is no known exploitation of CVE-2026-64223 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-64223, DEBIAN-CVE-2026-64223, GHSA-m9jr-3w64-2f4w, ROOT-OS-UBUNTU-2204-CVE-2026-64223, UBUNTU-CVE-2026-64223.