CVE-2026-97517 in Linux
Summary
by MITRE • 09/24/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: nl80211: reject beacons with bad HE operation
The HE operation element not only needs to be longer than the fixed part, but also have an appropriate size for the variable part inside of it. Check this.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/24/2026
A critical input validation vulnerability has been identified within the Linux kernel's wireless networking subsystem, specifically affecting the nl80211 interface which handles communication between user-space applications and the kernel driver regarding IEEE 802.11 standards. The flaw resides in the processing of High Efficiency (HE) operation elements found within beacon frames transmitted by access points or other network devices. Under normal operational parameters, these elements contain both fixed-length fields and variable-length components that define various capabilities and settings for Wi-Fi 6 and later connections. The vulnerability arises because the kernel previously failed to perform comprehensive length validation on the entire HE operation element structure before parsing its internal variables.
The technical root cause of this issue is a missing boundary check during the parsing phase of beacon frame processing. Specifically, while the system may have verified that the HE operation element exceeds the minimum fixed size requirement, it neglected to verify that the declared total length matches the actual available data for the variable portion contained within the element. This oversight allows an attacker or a misconfigured device to craft maliciously formatted beacons where the header claims a larger payload than is actually present in the frame buffer. When the kernel attempts to read beyond the allocated memory boundaries of this malformed structure, it triggers out-of-bounds reads. In severe cases, depending on how subsequent code handles these invalid pointers or lengths, this could potentially lead to information disclosure or system instability, although exploitation typically requires proximity to a vulnerable wireless interface and the ability to inject or manipulate beacon frames within range.
From an operational impact perspective, this vulnerability primarily affects devices running Linux kernels that include the affected nl80211 implementation. Systems actively scanning for networks or connected as clients are susceptible when processing beacons from untrusted sources. The immediate consequence is a potential denial of service if the kernel panics due to invalid memory access triggered by the malformed element. Furthermore, there is a risk of sensitive information leakage if the out-of-bounds read accesses adjacent kernel memory structures that contain confidential data such as cryptographic keys or internal state variables. This flaw undermines the integrity and reliability of wireless connectivity on affected systems, particularly in environments where devices frequently connect to public or unsecured networks with potentially compromised access points.
This vulnerability aligns with CWE-20 Improper Input Validation, as the system failed to correctly validate whether user-controlled input met all necessary structural constraints before processing. It also relates to CWE-125 Out-of-bounds Read, given that the parsing logic may attempt to access memory locations beyond the intended buffer limits due to incorrect length calculations. In terms of threat modeling and attack vectors, this falls under MITRE ATT&CK technique T1046 Network Service Scanning or potentially T1595 Active Scanning if used for reconnaissance, though more critically it represents a potential path for exploitation via T1203 Exploitation for Defense Evasion or initial access depending on the specific outcome of the memory corruption. The vulnerability highlights the importance of rigorous validation in network protocol parsers where malformed packets can be crafted by adversaries to trigger undefined behavior within privileged kernel space.
Mitigation strategies primarily involve applying the upstream Linux kernel patch that resolves this issue, which enforces strict length checks for both the fixed and variable parts of the HE operation element. System administrators should ensure their systems are updated with the latest stable kernel versions available from their distribution vendors. Until patches are applied, limiting wireless interface usage to trusted networks can reduce exposure risk. Additionally, deploying network intrusion detection systems that monitor for anomalous beacon frame structures may provide an additional layer of defense by identifying and alerting on packets containing malformed 802.11 elements indicative of this specific exploitation attempt. Regular security audits focusing on kernel module inputs are recommended to prevent similar validation oversights in other wireless protocol handlers.