CVE-2026-115698
Description
A flaw was found in iwd. Due to an improper comparison where the mobility domain check compares an element to itself rather than against the incoming frame, validation always succeeds. A network-adjacent attacker can exploit this issue by sending a crafted 802.11r Fast BSS Transition (FT) authentication response with arbitrary mobility domain parameters. This allows an attacker to bypass mobility domain verification and proceed into subsequent frame parsing and key derivation stages.
Statement
This vulnerability is rated as Low severity because an attacker must be within adjacent radio range during an 802.11r transition exchange, and subsequent cryptographic verification prevents an authentication bypass. In Red Hat enterprise distributions, wireless networking defaults to NetworkManager with wpa_supplicant rather than the iwd daemon. Consequently, supported systems do not expose this flaw under standard configurations, limiting impact primarily to non-default community deployments.
Understanding the Weakness (CWE)
Other
Technical Impact: Quality Degradation; Varies by Context
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
