CVE-2026-64117wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb
- 8.8HighCVSS base score
- 0.27%Exploitation in 30 daysEPSS · top 81% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb ieee80211_invoke_fast_rx() reads RX status through IEEE80211_SKB_RXCB(skb), which aliases the same skb->cb storage that ieee80211_rx_mesh_data() reuses as IEEE80211_TX_INFO. In the unicast forward path, mesh_data does: info = IEEE80211_SKB_CB(fwd_skb); memset(info, 0, sizeof(*info)); on the same skb the caller still names via rx->skb, then either queues the skb for TX (success) or kfree_skb()'s it (no-route) before returning RX_QUEUED. The caller's RX_QUEUED arm then calls sta_stats_encode_rate(status) on memory that is either zeroed (success path) or freed (no-route path). The latter is KASAN slab-use-after-free in ieee80211_prepare_and_rx_handle. Fix by encoding the rate from status before invoking ieee80211_rx_mesh_data(), so the RX_QUEUED arm consumes a value captured while status was still backed by valid memory.
Timeline
ID reserved
By Linux
Published
- 3 months later
· 3 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High8.8 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | High8.8 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.27% · top 81% of all CVEs (13 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.
Affected products
- affected 3468e1e0c639032a603450f0830ccabfa76f5806 – < 5fe97797412aa8bc0184f78379fafb594bcb7f66
- affected 3468e1e0c639032a603450f0830ccabfa76f5806 – < 0cd37e746e98ab0baa6d8b812955220775b080d6
- affected 3468e1e0c639032a603450f0830ccabfa76f5806 – < a2650f8461cd8ba287fee2992b36abe733c2bd5e
- affected 3468e1e0c639032a603450f0830ccabfa76f5806 – < 2fb64f94f9afb774f2fa0c7835727d7a67f89f07
- affected 3468e1e0c639032a603450f0830ccabfa76f5806 – < d71c841be5d9e586ee7f36c0dc8ed4db0d9a1349
- affected 6.4
- unaffected < 6.4
- unaffected 6.6.160 – ≤ 6.6.*
- unaffected 6.12.114 – ≤ 6.12.*
- unaffected 6.18.57 – ≤ 6.18.*
- unaffected 7.0.11 – ≤ 7.0.*
- unaffected 7.1 – ≤ *
References
References5
- https://git.kernel.org/stable/c/5fe97797412aa8bc0184f78379fafb594bcb7f66 (opens in a new tab)
- https://git.kernel.org/stable/c/0cd37e746e98ab0baa6d8b812955220775b080d6 (opens in a new tab)
- https://git.kernel.org/stable/c/a2650f8461cd8ba287fee2992b36abe733c2bd5e (opens in a new tab)
- https://git.kernel.org/stable/c/2fb64f94f9afb774f2fa0c7835727d7a67f89f07 (opens in a new tab)
- https://git.kernel.org/stable/c/d71c841be5d9e586ee7f36c0dc8ed4db0d9a1349 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-45802 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-64117)Record last updated .