CVE-2026-64223 in Linux
Summary
by MITRE • 07/24/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: consume only present negotiated TTLM maps
ieee80211_tid_to_link_map_size_ok() validates negotiated TTLM elements against the number of link-map entries indicated by link_map_presence. ieee80211_parse_neg_ttlm() must consume the same layout.
The parser advanced its cursor for every TID, including TIDs whose presence bit is clear and therefore have no map bytes in the element. A sparse map can then make a later present TID read past the validated element.
The bad bytes land in neg_ttlm->{up,down}link[tid] but are gated by
valid_links before being applied to driver state, so a peer cannot turn the read into a policy change. Under KUnit + KASAN with an exact-sized element allocation the OOB read is reported as a slab-out-of-bounds; whether the same trigger fires under the production RX path depends on surrounding allocator state.
Advance the cursor only when the current TID has a map present.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/27/2026
This vulnerability exists within the linux kernel's mac80211 subsystem which handles wireless networking protocols particularly in ieee80211 implementations. The flaw resides in how the system processes negotiated transmission time to link map (TTLM) elements during wifi communication setup. The core issue manifests when parsing TTLM elements that contain sparse mapping information where certain traffic identifier (TID) entries may be marked as absent while others remain present.
The technical flaw occurs in the ieee80211_parse_neg_ttlm() function which improperly advances its parsing cursor for every TID encountered regardless of whether that TID has an actual map entry present. This function fails to properly validate against the link_map_presence indicator that should dictate which TIDs actually contain valid mapping data. The ieee80211_tid_to_link_map_size_ok() validation function correctly checks against the number of present link-map entries but this validation occurs after the parsing step has already advanced beyond the bounds of valid data.
When processing sparse TTLM maps, the parser moves through memory locations corresponding to TIDs even when their presence bits are clear, causing it to read beyond the actual element boundaries. This creates a potential out-of-bounds memory read scenario where the parser attempts to access memory locations that were not part of the originally validated element structure. The vulnerability stems from a mismatch between validation logic and parsing implementation, specifically violating the principle of proper bounds checking.
The operational impact of this vulnerability is significant for wireless network stability and security. While the system does provide some protection through valid_links gating before applying values to driver state, preventing direct policy manipulation, the underlying out-of-bounds read can still cause memory corruption or data leakage. The vulnerability affects the wireless subsystem's ability to properly handle sparse TTLM elements which are legitimate in certain network configurations. Under specific conditions with exact-sized allocations and KASAN enabled, this manifests as a slab-out-of-bounds error, though similar triggers may not occur in production RX paths due to allocator state variations.
This vulnerability aligns with CWE-129 Input Validation and CWE-787 Out-of-bounds Write patterns, representing improper handling of data structures that could lead to memory corruption. The issue also relates to ATT&CK technique T1059 Command and Scripting Interpreter where malicious actors could potentially exploit memory corruption for privilege escalation or denial of service attacks. The fix implements proper cursor advancement logic that only progresses through the parsing when a TID actually has a present map entry, ensuring that the parser respects the link_map_presence indicator. This remediation prevents the out-of-bounds read while maintaining compatibility with legitimate sparse TTLM element structures used in wireless networking protocols.