SB20260816538 - Improper input validation in Linux kernel ieee80211_mle_size_ok() and ieee80211_mle_common_size()

Description

This security bulletin contains information about 1 vulnerability.

1) Improper input validation (CVE-ID: CVE-2026-68471)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in ieee80211_mle_size_ok() and ieee80211_mle_common_size() when parsing multi-link element data. A remote attacker can send specially crafted MLE data to cause a denial of service.

The issue affects validation of advertised common information lengths for known MLE types, including Reconfiguration and Priority Access MLEs.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/293baeae9b2434a3e432629d7720b5603db2d77e
• https://git.kernel.org/stable/c/2b1589fd9a076727a73bfb39e96622a76415ad32
• https://git.kernel.org/stable/c/90576bd6921a91eb038bffbb4b9467c2dc26aa1d