# CVE-2026-74336: wifi: mac80211: bound S1G TIM PVB walk to the TIM element

> An out-of-bounds read in the Linux kernel Wi-Fi driver allows attackers to read adjacent memory data via crafted S1G TIM elements.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 15 Aug 2026
- **Updated:** 15 Oct 2026
- **Also known as:** BELL-CVE-2026-74336, DEBIAN-CVE-2026-74336, GHSA-4qq5-4vgc-w78g, UBUNTU-CVE-2026-74336

## What is CVE-2026-74336?

CVE-2026-74336 is a vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: bound S1G TIM PVB walk to the TIM element

ieee80211_s1g_check_tim() parses the S1G Partial Virtual Bitmap (PVB) of a
received TIM element. The TIM is handed in as the element payload:
ieee802_11_parse_elems_full() stores elems->tim = elem->data and
elems->tim_len = elem->datalen (net/mac80211/parse.c), so the valid bytes
are [tim, tim + tim_len).

When walking the encoded blocks the function passes the walker an end
sentinel of (const u8 *)tim + tim_len + 2, i.e. two bytes past the end of
the element. ieee80211_s1g_find_target_block() loops while (ptr + 1 <= end)
and dereferences ptr (and the per-mode ieee80211_s1g_len_*() helpers read
*ptr), so it can read up to two bytes beyond the TIM element -- an
out-of-bounds read of adjacent skb/heap data when the TIM is the last
element in the frame. The +2 appears to account for the element id/len
header, but tim already points past that header at the element payload, so
the addend is wrong.

Pass the correct element end, (const u8 *)tim + tim_len.

## Which versions are affected by CVE-2026-74336?


## How do I fix CVE-2026-74336?

Apply the vendor's patch.

## Is CVE-2026-74336 being exploited?

There is no known exploitation of CVE-2026-74336 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-74336 and fix it if it is affected.

What it is: CVE-2026-74336 is a vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-74336 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-74336/ (Markdown: https://insights.sbomify.com/CVE-2026-74336/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-74336
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-74336
- OSV: https://osv.dev/vulnerability/CVE-2026-74336

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-74336/
Summaries are generated and may contain mistakes; the official description above is the record.