CVE-2026-64030

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs IEEE80211_MLE_STA_EPCS_CONTROL_LINK_ID is 0x000f, so link_id extracted from a PRIO_ACCESS ML element PER_STA_PROFILE subelement can be 0..15. sdata->link[] has IEEE80211_MLD_MAX_NUM_LINKS (15) entries (indices 0..14), making index 15 out-of-bounds. A connected WiFi 7 AP can trigger this by sending an EPCS Enable Response action frame with a PER_STA_PROFILE subelement where link_id = 15. The unsolicited-notification path (dialog_token = 0) is reachable any time EPCS is already enabled, without any prior client request. sdata->link[15] reads into the first word of sdata->activate_links_work (a wiphy_work whose embedded list_head is non-NULL after INIT_LIST_HEAD), so the NULL check on the result does not catch the invalid access. The garbage pointer is then passed to ieee80211_sta_wmm_params(), which dereferences link->sdata and crashes the kernel. The same class of bug was fixed for ieee80211_ml_reconfiguration() by commit 162d331d833d ("wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration").

• CWE-125
• CWE-125

• https://git.kernel.org/stable/c/2d8379834800c30602f24c71ab7c40f5fe84d200Patch
• https://git.kernel.org/stable/c/863f1f02a3bd70dbd857b8ac4070292fde8cb4e2Patch
• https://git.kernel.org/stable/c/f718506edd2d9c6a308ded9d13c632bf7b7d5a2cPatch

Published

Jul 19, 2026

Last Modified

Oct 19, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-64025In the Linux kernel, the following vulnerability has been re…9.8
• CVE-2026-64026In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-64027In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-64028In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-64029In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-6403The Quick Playground plugin for WordPress is vulnerable to P…7.5
• CVE-2026-64031In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-64032In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-64033In the Linux kernel, the following vulnerability has been re…9.8
• CVE-2026-64034In the Linux kernel, the following vulnerability has been re…9.3
• CVE-2026-64035In the Linux kernel, the following vulnerability has been re…9.8
• CVE-2026-64036In the Linux kernel, the following vulnerability has been re…7.8