CyberSecBulletin
CVE-2026-68402NVD status: Received

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2026-68402 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 7.1 out of 10. It can be exploited from the same local network by an unauthenticated attacker, without any action from a user. The record lists versions 521dd5fe6d12b0d3c275f919738dc3a07117f4a5, 24154c172246ae3f0e69bb17c9111095685ceedc, 2d31ebb26a14f103c9cdc5287fb20cb2d4bde901 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.27% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 521dd5fe6d12b0d3c275f919738dc3a07117f4a5 or 24154c172246ae3f0e69bb17c9111095685ceedc or 2d31ebb26a14f103c9cdc5287fb20cb2d4bde901 or 20c308d9a57722801961f816395bf825f7bde6bc, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxf7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 up to, but not including, 521dd5fe6d12b0d3c275f919738dc3a07117f4a5; f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 up to, but not including, 24154c172246ae3f0e69bb17c9111095685ceedc; f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 up to, but not including, 2d31ebb26a14f103c9cdc5287fb20cb2d4bde901; f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 up to, but not including, 20c308d9a57722801961f816395bf825f7bde6bc; f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 up to, but not including, 84bd907361c56fbd5523eceb2682cb39da059bd5; f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 up to, but not including, 11ac7a5e75f5132f1778e0c60981d30dc29fb869; f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 up to, but not including, ddf2773bcc8e49a43c561f22ec1e7924215d7947; f7dacfb11475ba777e1e84ccec2e14b0ba5a17a3 up to, but not including, cb8afea4655ff004fa7feee825d5c79783525383; and 1 more ranges521dd5fe6d12b0d3c275f919738dc3a07117f4a5, 24154c172246ae3f0e69bb17c9111095685ceedc, 2d31ebb26a14f103c9cdc5287fb20cb2d4bde901, 20c308d9a57722801961f816395bf825f7bde6bc, 84bd907361c56fbd5523eceb2682cb39da059bd5, 11ac7a5e75f5132f1778e0c60981d30dc29fb869

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
AdjacentThe attacker must be on the same local network segment.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
LowSome restricted data can be read.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: bound element ID read when checking non-inheritance cfg80211_is_element_inherited() reads the first data octet of the candidate element (id = elem->data[0]) to look it up in an extension non-inheritance list. It does so after testing elem->id, but without verifying that the element actually has a data octet. A zero-length extension element (WLAN_EID_EXTENSION with length 0) therefore makes it read one octet past the end of the element. _ieee802_11_parse_elems_full() runs this check for every element of a frame once a non-inheritance context exists -- e.g. while parsing a per-STA profile of a Multi-Link element in a (re)association response, or a non-transmitted BSS profile -- so a crafted frame from an AP can trigger a one-octet slab-out-of-bounds read during element parsing: BUG: KASAN: slab-out-of-bounds in cfg80211_is_element_inherited Read of size 1 ... in net/wireless/scan.c Return early (treat the element as inherited) when an extension element carries no data, mirroring the existing handling of empty ID lists. The bug was found by fuzzing ieee802_11_parse_elems_full() under KASAN.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.