CVE-2026-68402

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: bound element ID read when checking non-inheritance cfg80211_is_element_inherited() reads the first data octet of the candidate element (id = elem->data[0]) to look it up in an extension non-inheritance list. It does so after testing elem->id, but without verifying that the element actually has a data octet. A zero-length extension element (WLAN_EID_EXTENSION with length 0) therefore makes it read one octet past the end of the element. _ieee802_11_parse_elems_full() runs this check for every element of a frame once a non-inheritance context exists -- e.g. while parsing a per-STA profile of a Multi-Link element in a (re)association response, or a non-transmitted BSS profile -- so a crafted frame from an AP can trigger a one-octet slab-out-of-bounds read during element parsing: BUG: KASAN: slab-out-of-bounds in cfg80211_is_element_inherited Read of size 1 ... in net/wireless/scan.c Return early (treat the element as inherited) when an extension element carries no data, mirroring the existing handling of empty ID lists. The bug was found by fuzzing ieee802_11_parse_elems_full() under KASAN.

Gravité et risque d'exploitation

CVE-2026-68402 obtient un score CVSS de 7.1/10, soit une gravité élevée. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 0.27 %, ce qui la place devant 17.3 % des CVE référencées.

Que faire ?

• Vérifiez si Linux (versions <cb8afea4655ff004fa7feee825d5c79783525383, <=6.1.*, <=6.12.*, 6.12.101, 5.2, 0, <=7.1.*, 5.15.216, <=5.10.*, <=6.6.*, 6.18.42, 7.1.6, <24154c172246ae3f0e69bb17c9111095685ceedc, 6.1.183, <=6.18.*, <11ac7a5e75f5132f1778e0c60981d30dc29fb869, <2d31ebb26a14f103c9cdc5287fb20cb2d4bde901, f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3, <=*, <521dd5fe6d12b0d3c275f919738dc3a07117f4a5, <=5.15.*, <20c308d9a57722801961f816395bf825f7bde6bc, <84bd907361c56fbd5523eceb2682cb39da059bd5, <ddf2773bcc8e49a43c561f22ec1e7924215d7947, 5.10.265, 6.6.148, 7.2, <5.2) est présent sur votre parc.
• Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
• À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
• Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.

Références

• https://git.kernel.org/stable/c/521dd5fe6d12b0d3c275f919738dc3a07117f4a5
• https://git.kernel.org/stable/c/24154c172246ae3f0e69bb17c9111095685ceedc
• https://git.kernel.org/stable/c/2d31ebb26a14f103c9cdc5287fb20cb2d4bde901
• https://git.kernel.org/stable/c/20c308d9a57722801961f816395bf825f7bde6bc
• https://git.kernel.org/stable/c/84bd907361c56fbd5523eceb2682cb39da059bd5
• https://git.kernel.org/stable/c/11ac7a5e75f5132f1778e0c60981d30dc29fb869
• https://git.kernel.org/stable/c/ddf2773bcc8e49a43c561f22ec1e7924215d7947
• https://git.kernel.org/stable/c/cb8afea4655ff004fa7feee825d5c79783525383