CVE-2026-64030 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs
IEEE80211_MLE_STA_EPCS_CONTROL_LINK_ID is 0x000f, so link_id extracted from a PRIO_ACCESS ML element PER_STA_PROFILE subelement can be 0..15. sdata->link[] has IEEE80211_MLD_MAX_NUM_LINKS (15) entries (indices 0..14),
making index 15 out-of-bounds.
A connected WiFi 7 AP can trigger this by sending an EPCS Enable Response action frame with a PER_STA_PROFILE subelement where link_id = 15. The unsolicited-notification path (dialog_token = 0) is reachable any time EPCS is already enabled, without any prior client request.
sdata->link[15] reads into the first word of sdata->activate_links_work
(a wiphy_work whose embedded list_head is non-NULL after INIT_LIST_HEAD), so the NULL check on the result does not catch the invalid access. The garbage pointer is then passed to ieee80211_sta_wmm_params(), which dereferences link->sdata and crashes the kernel.
The same class of bug was fixed for ieee80211_ml_reconfiguration() by commit 162d331d833d ("wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration").
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/20/2026
The vulnerability resides within the linux kernel's mac80211 wireless subsystem, specifically in the handling of EPCS (Enhanced Power Save) configuration within WiFi 7 networks. This issue manifests as a classic buffer overflow condition that occurs when processing IEEE80211_MLE_STA_EPCS_CONTROL_LINK_ID values extracted from PRIO_ACCESS ML elements. The fundamental flaw lies in the improper bounds checking of link_id values, where the system accepts link_id values ranging from 0 to 15 while the internal sdata->link array only accommodates indices 0 through 14, creating a direct out-of-bounds memory access scenario.
The technical implementation of this vulnerability exploits the mismatch between the maximum allowed link_id value of 15 and the actual array size of IEEE80211_MLD_MAX_NUM_LINKS which equals 15 but uses zero-based indexing. When an attacker-controlled access point sends an EPCS Enable Response action frame containing a PER_STA_PROFILE subelement with link_id set to 15, the kernel performs an invalid memory read operation that accesses sdata->link[15], which actually maps to the first word of sdata->activate_links_work structure. This memory layout causes the system to read from a wiphy_work structure whose embedded list_head is non-null after INIT_LIST_HEAD initialization, bypassing standard NULL checks that would normally detect such invalid memory access patterns.
The operational impact of this vulnerability represents a critical kernel panic condition that can be triggered remotely by any connected WiFi 7 access point without requiring prior client interaction or authentication. The unsolicited-notification path becomes accessible anytime EPCS is already enabled, making this attack vector particularly dangerous as it can be exploited at any time during an active wireless session. The crash occurs when the invalid pointer, derived from the out-of-bounds memory access, gets passed to ieee80211_sta_wmm_params() function which then attempts to dereference link->sdata, resulting in immediate kernel termination and system instability.
This vulnerability type aligns with CWE-129: "Improper Validation of Array Index" and represents a classic example of bounds checking failure that can lead to arbitrary code execution or denial of service attacks. The flaw follows ATT&CK technique T1059.006 for kernel-level privilege escalation through memory corruption, and T1482 for network-based system compromise via wireless protocols. The vulnerability was previously addressed in a similar context within ieee80211_ml_reconfiguration() function through commit 162d331d833d, indicating that the fix pattern was already established and understood by kernel developers. The remediation approach should involve implementing proper bounds validation before array indexing operations, ensuring that link_id values are strictly validated against the maximum allowed index range of 0-14 inclusive rather than allowing potentially invalid values to proceed to memory access operations.