Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-24T00:00:00 kernel: wifi: mac80211: consume only present negotiated TTLM maps 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CWE-125

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: consume only present negotiated TTLM maps ieee80211_tid_to_link_map_size_ok() validates negotiated TTLM elements against the number of link-map entries indicated by link_map_presence. ieee80211_parse_neg_ttlm() must consume the same layout. The parser advanced its cursor for every TID, including TIDs whose presence bit is clear and therefore have no map bytes in the element. A sparse map can then make a later present TID read past the validated element. The bad bytes land in neg_ttlm->{up,down}link[tid] but are gated by valid_links before being applied to driver state, so a peer cannot turn the read into a policy change. Under KUnit + KASAN with an exact-sized element allocation the OOB read is reported as a slab-out-of-bounds; whether the same trigger fires under the production RX path depends on surrounding allocator state. Advance the cursor only when the current TID has a map present.

A flaw was found in the Linux kernel's mac80211 Wi-Fi driver. This vulnerability, an out-of-bounds read, occurs when parsing negotiated Time-To-Live Map (TTLM) elements. A remote attacker could craft a sparse map, causing the parser to read beyond the intended memory boundary. While direct policy changes are prevented, this issue can lead to memory corruption, potentially impacting system stability.

Red Hat Enterprise Linux 10 Fix deferred kernel Red Hat Enterprise Linux 6 Out of support scope kernel Red Hat Enterprise Linux 7 Not affected kernel Red Hat Enterprise Linux 7 Not affected kernel-rt Red Hat Enterprise Linux 8 Not affected kernel Red Hat Enterprise Linux 8 Not affected kernel-rt Red Hat Enterprise Linux 9 Fix deferred kernel Red Hat Enterprise Linux 9 Fix deferred kernel-rt https://www.cve.org/CVERecord?id=CVE-2026-64223 https://nvd.nist.gov/vuln/detail/CVE-2026-64223 https://lore.kernel.org/linux-cve-announce/2026072417-CVE-2026-64223-b945@gregkh/T