CVE-2026-68402 wifi: cfg80211: bound element ID read when checking non-inheritance
A crafted Wi-Fi frame triggers a one-byte out-of-bounds read in the Linux kernel, potentially leaking memory or causing a crash.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-68402?
CVE-2026-68402 is a high-severity memory corruption vulnerability in Linux, published on 10 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: bound element ID read when checking non-inheritance
cfg80211_is_element_inherited() reads the first data octet of the candidate element (id = elem->data[0]) to look it up in an extension non-inheritance list. It does so after testing elem->id, but without verifying that the element actually has a data octet. A zero-length extension element (WLAN_EID_EXTENSION with length 0) therefore makes it read one octet past the end of the element.
_ieee802_11_parse_elems_full() runs this check for every element of a frame once a non-inheritance context exists -- e.g. while parsing a per-STA profile of a Multi-Link element in a (re)association response, or a non-transmitted BSS profile -- so a crafted frame from an AP can trigger a one-octet slab-out-of-bounds read during element parsing:
BUG: KASAN: slab-out-of-bounds in cfg80211_is_element_inherited Read of size 1 ... in net/wireless/scan.c
Return early (treat the element as inherited) when an extension element carries no data, mirroring the existing handling of empty ID lists.
The bug was found by fuzzing ieee802_11_parse_elems_full() under KASAN.
Weakness: CWE-125
Which versions are affected by CVE-2026-68402?
How do I fix CVE-2026-68402?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-68402 being exploited?
There is no known exploitation of CVE-2026-68402 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-68402, DEBIAN-CVE-2026-68402, GHSA-755j-4fg9-vf62, UBUNTU-CVE-2026-68402.