CVE-2026-74336 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: bound S1G TIM PVB walk to the TIM element
ieee80211_s1g_check_tim() parses the S1G Partial Virtual Bitmap (PVB) of a received TIM element. The TIM is handed in as the element payload: ieee802_11_parse_elems_full() stores elems->tim = elem->data and elems->tim_len = elem->datalen (net/mac80211/parse.c), so the valid bytes are [tim, tim + tim_len).
When walking the encoded blocks the function passes the walker an end sentinel of (const u8 *)tim + tim_len + 2, i.e. two bytes past the end of the element. ieee80211_s1g_find_target_block() loops while (ptr + 1 <= end) and dereferences ptr (and the per-mode ieee80211_s1g_len_*() helpers read *ptr), so it can read up to two bytes beyond the TIM element -- an out-of-bounds read of adjacent skb/heap data when the TIM is the last element in the frame. The +2 appears to account for the element id/len header, but tim already points past that header at the element payload, so the addend is wrong.
Pass the correct element end, (const u8 *)tim + tim_len.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability exists within the linux kernel's mac80211 wireless subsystem where the ieee80211_s1g_check_tim() function processes S1G Partial Virtual Bitmap (PVB) data from received TIM elements. The issue stems from incorrect boundary calculations during parsing operations that lead to out-of-bounds memory access patterns. When processing wireless management frames, the kernel's ieee802_11_parse_elems_full() function correctly stores the TIM element payload at elems->tim with length elems->tim_len, establishing valid data boundaries from tim to tim + tim_len. However, the ieee80211_s1g_check_tim() function incorrectly calculates the end sentinel for block walking operations by adding an extra two bytes beyond the actual payload boundaries. This miscalculation occurs because the code treats tim as pointing to the element header rather than the payload data, causing the walker to reference memory locations that extend beyond the legitimate TIM element boundaries.
The operational impact of this vulnerability manifests when a TIM element serves as the final element in a wireless frame structure. During the S1G PVB block traversal process, the ieee80211_s1g_find_target_block() function iterates while ptr + 1 <= end and performs memory dereferences through ptr, allowing the code to read up to two bytes beyond the intended TIM element boundaries. This results in an out-of-bounds read that accesses adjacent kernel heap or socket buffer data, potentially exposing sensitive information or enabling further exploitation techniques. The vulnerability represents a classic buffer overread condition that violates fundamental memory safety principles and can be categorized under CWE-125 as an out-of-bounds read.
The security implications extend beyond simple information disclosure to potential privilege escalation vectors and system stability concerns within wireless networking operations. Attackers could craft malicious TIM elements designed to trigger this out-of-bounds access pattern, potentially leading to kernel memory corruption or information leakage from adjacent data structures. This vulnerability aligns with ATT&CK technique T1059.007 for kernel-level code execution through memory corruption and represents a critical weakness in the wireless subsystem's frame parsing logic. The fix involves correcting the boundary calculation by passing the proper element end pointer as (const u8 )tim + tim_len instead of the erroneous (const u8 )tim + tim_len + 2, ensuring that all memory access operations remain within legitimate element boundaries and preventing access to adjacent kernel data structures.
This vulnerability demonstrates the complexity involved in wireless frame parsing operations where element headers must be carefully distinguished from payload data. The error highlights common pitfalls in boundary calculations when dealing with variable-length elements in IEEE 802.11 frame structures, particularly in the specialized S1G (Single Carrier) mode implementations. Proper validation of memory access boundaries becomes crucial in kernel space operations where incorrect bounds checking can lead to system instability or security compromise. The fix addresses a fundamental parsing error that affects the entire mac80211 subsystem's handling of TIM elements and related wireless management frame processing, emphasizing the importance of careful boundary accounting in kernel networking code where memory safety directly impacts overall system integrity and wireless communication security.