PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-64030 Linux CVE debrief

A bounds-checking vulnerability exists in the Linux kernel's wifi: mac80211 module. The issue arises from the extraction of link_id from a PRIO_ACCESS ML element PER_STA_PROFILE subelement, which can range from 0 to 15. However, the sdata->link[] array has only 15 entries (indices 0-14), making index 15 out-of-bounds. A connected WiFi 7 AP can trigger this by sending an EPCS Enable Response action frame with a PER_STA_PROFILE subelement where link_id = 15. This can cause a crash when the garbage pointer is passed to ieee80211_sta_wmm_params(). The vulnerability can be mitigated by applying patches or updating the Linux kernel to the latest version.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-19
Original CVE updated
2026-07-19
Advisory published
2026-07-19
Advisory updated
2026-07-19

Who should care

Linux kernel users and administrators, as well as operators, platforms, vulnerability-management teams, and security teams, should be aware of this vulnerability and take steps to mitigate it. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Affected deployments in managed environments need to be confirmed and assigned an owner for follow-up.

Technical summary

The Linux kernel's wifi: mac80211 module has a bounds-checking vulnerability. The link_id extracted from a PRIO_ACCESS ML element PER_STA_PROFILE subelement can range from 0 to 15. However, the sdata->link[] array has only 15 entries (indices 0-14). A connected WiFi 7 AP can trigger this by sending an EPCS Enable Response action frame with a PER_STA_PROFILE subelement where link_id = 15. This can cause a crash when the garbage pointer is passed to ieee80211_sta_wmm_params(). A similar bug was fixed in ieee80211_ml_reconfiguration() by commit 162d331d833d.

Defensive priority

High

Recommended defensive actions

  • Apply the patch from commit 2d8379834800c30602f24c71ab7c40f5fe84d200
  • Apply the patch from commit 863f1f02a3bd70dbd857b8ac4070292fde8cb4e2
  • Apply the patch from commit f718506edd2d9c6a308ded9d13c632bf7b7d5a2c
  • Update Linux kernel to the latest version
  • Monitor for suspicious WiFi traffic
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record was published on 2026-07-19T16:17:43.147Z and has not been modified since then. The NVD entry is currently Received. There is limited information available about the vulnerability, and defenders should verify the affected scope and severity with the vendor. The CVE record does not provide specific details about the vulnerability, but it mentions that a connected WiFi 7 AP can trigger the vulnerability by sending an EPCS Enable Response action frame with a PER_STA_PROFILE subelement where link_id = 15.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-19T16:17:43.147Z and has not been modified since then.