Linux Kernel up to 7.1.4 mac80211 net/mac80211/parse.c ieee80211_s1g_check_tim out-of-bounds

Summaryinfo

A vulnerability was found in Linux Kernel up to 7.1.4. It has been declared as critical. The impacted element is the function ieee80211_s1g_check_tim of the file net/mac80211/parse.c of the component mac80211. Executing a manipulation can lead to out-of-bounds. This vulnerability appears as CVE-2026-74336. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability has been found in Linux Kernel up to 7.1.4 and classified as critical. This vulnerability affects the function ieee80211_s1g_check_tim of the file net/mac80211/parse.c of the component mac80211. The manipulation with an unknown input leads to a out-of-bounds vulnerability. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bound S1G TIM PVB walk to the TIM element ieee80211_s1g_check_tim() parses the S1G Partial Virtual Bitmap (PVB) of a received TIM element. The TIM is handed in as the element payload: ieee802_11_parse_elems_full() stores elems->tim = elem->data and elems->tim_len = elem->datalen (net/mac80211/parse.c), so the valid bytes are [tim, tim + tim_len). When walking the encoded blocks the function passes the walker an end sentinel of (const u8 *)tim + tim_len + 2, i.e. two bytes past the end of the element. ieee80211_s1g_find_target_block() loops while (ptr + 1 <= end) and dereferences ptr (and the per-mode ieee80211_s1g_len_*() helpers read *ptr), so it can read up to two bytes beyond the TIM element -- an out-of-bounds read of adjacent skb/heap data when the TIM is the last element in the frame. The +2 appears to account for the element id/len header, but tim already points past that header at the element payload, so the addend is wrong. Pass the correct element end, (const u8 *)tim + tim_len.

The advisory is available at git.kernel.org. This vulnerability was named CVE-2026-74336 since 08/15/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 08/15/2026).

Upgrading to version 7.1.5 or 7.2-rc1 eliminates this vulnerability. Applying the patch 3abc13ec3ac28c343ad7e7b7496e807b924f0edd/b224d18b1e5d1cddfc67f63f41d80023b2ec8889 is able to eliminate this problem.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.1.0
• 7.1.1
• 7.1.2
• 7.1.3
• 7.1.4

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion