CVE-2026-64174 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: advance loop vars in cfg80211_merge_profile()
cfg80211_merge_profile() reassembles a Multi-BSSID non-transmitted BSS profile that has been split across multiple consecutive MBSSID elements. Its while-loop calls
cfg80211_get_profile_continuation(ie, ielen, mbssid_elem, sub_elem)
but never advances mbssid_elem or sub_elem inside the body. Each iteration therefore searches for a continuation that follows the same fixed pair; the helper returns the same next_mbssid; and the same next_sub bytes are memcpy()'d into merged_ie at a growing offset until the buffer fills.
Advance both mbssid_elem and sub_elem to the just-consumed continuation so the next call to cfg80211_get_profile_continuation() searches for a further continuation beyond it (or returns NULL when none exists).
A specially-crafted malicious beacon can take advantage of this bug to cause the kernel to spend an excessive amount of time in cfg80211_merge_profile (up to as much as 2ms per beacon received), which could theoretically be abused in some way.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/20/2026
The vulnerability resides within the Linux kernel's wireless subsystem, specifically in the cfg80211 component responsible for managing wireless configuration and BSS (Basic Service Set) profiles. This flaw manifests in the cfg80211_merge_profile() function which handles reassembly of Multi-BSSID non-transmitted BSS profiles that have been fragmented across multiple MBSSID elements within beacon frames. The issue stems from improper loop variable management during iterative processing of wireless configuration elements, creating a condition where the function fails to advance its iteration pointers correctly.
The technical implementation flaw occurs when the while-loop processes consecutive MBSSID elements by calling cfg80211_get_profile_continuation() to locate continuation data. However, the function does not increment the mbssid_elem or sub_elem pointers after each iteration, causing subsequent calls to process identical memory locations repeatedly. This creates an infinite loop scenario where the same continuation data is continuously retrieved and copied into the merged_ie buffer at increasing offsets until buffer exhaustion occurs. The vulnerability represents a classic case of improper loop variable advancement that leads to excessive computational overhead.
The operational impact of this vulnerability allows malicious actors to craft specially designed beacon frames that can cause significant performance degradation in kernel wireless processing. Each malformed beacon can trigger the vulnerable code path, potentially consuming up to 2 milliseconds of kernel processing time per frame received. This creates a denial-of-service vector where an attacker could flood a system with such beacons, overwhelming the wireless subsystem and potentially affecting overall system responsiveness. The vulnerability aligns with CWE-691, which addresses insufficient control flow management in loops.
From an attack perspective, this vulnerability maps to techniques described in the MITRE ATT&CK framework under T1489, specifically targeting system resource consumption through wireless network protocols. The excessive CPU utilization could be leveraged to create persistent denial-of-service conditions against wireless infrastructure or mobile devices that process these malformed frames. Network administrators should consider implementing wireless intrusion detection systems and beacon filtering mechanisms to mitigate potential exploitation attempts.
The fix for this vulnerability involves ensuring that both mbssid_elem and sub_elem pointers are properly advanced to the end of the consumed continuation data after each iteration of the while-loop. This allows subsequent calls to cfg80211_get_profile_continuation() to search for continuations starting from the next available position in the wireless configuration elements rather than repeatedly processing the same data. This correction addresses the root cause by implementing proper loop control flow management and prevents the buffer exhaustion condition that leads to excessive kernel processing time. The resolution demonstrates proper software engineering practices for managing iterative processing of variable-length data structures within kernel space operations.