CVE-2026-64117 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb
ieee80211_invoke_fast_rx() reads RX status through IEEE80211_SKB_RXCB(skb), which aliases the same skb->cb storage that ieee80211_rx_mesh_data() reuses as IEEE80211_TX_INFO. In the unicast forward path, mesh_data does:
info = IEEE80211_SKB_CB(fwd_skb); memset(info, 0, sizeof(*info));
on the same skb the caller still names via rx->skb, then either queues the skb for TX (success) or kfree_skb()'s it (no-route) before returning RX_QUEUED. The caller's RX_QUEUED arm then calls sta_stats_encode_rate(status) on memory that is either zeroed (success path) or freed (no-route path). The latter is KASAN slab-use-after-free in ieee80211_prepare_and_rx_handle.
Fix by encoding the rate from status before invoking ieee80211_rx_mesh_data(), so the RX_QUEUED arm consumes a value captured while status was still backed by valid memory.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/19/2026
This vulnerability exists within the linux kernel's mac80211 wireless subsystem where a use-after-free condition occurs during mesh network packet processing. The flaw stems from improper handling of shared memory structures between different code paths that process wireless frames. Specifically, the ieee80211_invoke_fast_rx() function accesses RX status information through IEEE80211_SKB_RXCB(skb) which shares the same underlying skb->cb storage area as IEEE80211_TX_INFO used by ieee80211_rx_mesh_data(). This memory aliasing creates a race condition where the same memory location gets overwritten or freed before it can be safely accessed by subsequent code paths. The vulnerability manifests in the unicast forward path where mesh data processing first clears the info structure via memset(info, 0, sizeof(*info)) on the same skb that is later referenced by the RX_QUEUED handler, creating a scenario where memory that was previously valid becomes invalid before final consumption.
The technical implementation of this flaw involves improper resource management within the wireless frame processing pipeline. When packets are forwarded through mesh networks, the system allocates memory for packet metadata in the skb->cb area which serves dual purposes - storing RX status information for fast reception paths and TX information for mesh data forwarding operations. The ieee80211_rx_mesh_data() function reuses this same memory region by clearing it with memset before potentially passing the skb to either a transmission queue or freeing it through kfree_skb(). However, the calling code path that handles RX_QUEUED continues to reference this memory location after it may have been modified or freed, leading to undefined behavior and potential security implications.
This vulnerability directly relates to CWE-416 which describes use-after-free conditions in software systems. The flaw represents a classic memory safety issue where the same memory region is accessed after its lifetime has ended, creating opportunities for information disclosure, denial of service, or potentially arbitrary code execution depending on system configuration and attacker control over input packets. The issue affects wireless mesh networking functionality within linux kernel versions that implement the mac80211 subsystem and specifically impacts systems using 802.11s mesh networking protocols where packet forwarding occurs through mesh data paths.
The operational impact of this vulnerability extends beyond simple memory corruption to potentially compromise wireless network stability and security. Attackers could exploit this condition by crafting malicious mesh frames that trigger the specific code path leading to use-after-free behavior, potentially causing kernel panics, system crashes, or enabling privilege escalation attacks depending on how the freed memory is subsequently allocated. The KASAN slab-use-after-free detection confirms that this represents a serious memory management error where the kernel's memory allocator detects and reports improper access patterns. Organizations running wireless mesh networks in production environments should consider this vulnerability as potentially critical due to its potential to disrupt network services and create attack vectors through malformed packet processing.
The fix implemented addresses this by capturing the fast-RX rate information from status before invoking ieee80211_rx_mesh_data() so that the RX_QUEUED handler consumes a value that was captured while the memory was still valid. This solution follows established security practices for preventing use-after-free conditions by ensuring data dependencies are resolved before shared memory regions are modified or freed. The approach aligns with ATT&CK technique T1059.007 which involves command and scripting interpreter usage, as it requires careful handling of system call interfaces and kernel memory management to prevent unauthorized access patterns. This mitigation ensures that rate information processing occurs within the proper temporal boundaries of memory validity, preventing the scenario where freed memory is accessed during packet processing operations. The fix demonstrates proper resource lifecycle management and follows kernel security best practices for handling shared data structures in concurrent wireless packet processing environments while maintaining backward compatibility with existing mesh networking functionality.