CyberSecBulletin
CVE-2026-68470NVD status: Received

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate…

Published Updated By the CyberSecBulletin desk

CVE-2026-68470 is a high-severity improper input validation vulnerability in Linux, with a CVSS 3.1 base score of 8.8 out of 10. It can be exploited from the same local network by an unauthenticated attacker, without any action from a user. The record lists versions 7aba69b611007e11b9b93118ff8fe88998c3107f, 1c3d9c6bd5b795f3b952b40d574c8e424e14a39b, 625fc704b19cb48d7d269ad54ffffb4d3bf9c7ed as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.31% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 7aba69b611007e11b9b93118ff8fe88998c3107f or 1c3d9c6bd5b795f3b952b40d574c8e424e14a39b or 625fc704b19cb48d7d269ad54ffffb4d3bf9c7ed or 57d503ce32eccfa7650065ca4c560f7e29a2e676, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux09a740ce352e1a1d16b9984115514ba9a4f4704b up to, but not including, 7aba69b611007e11b9b93118ff8fe88998c3107f; 09a740ce352e1a1d16b9984115514ba9a4f4704b up to, but not including, 1c3d9c6bd5b795f3b952b40d574c8e424e14a39b; 09a740ce352e1a1d16b9984115514ba9a4f4704b up to, but not including, 625fc704b19cb48d7d269ad54ffffb4d3bf9c7ed; 09a740ce352e1a1d16b9984115514ba9a4f4704b up to, but not including, 57d503ce32eccfa7650065ca4c560f7e29a2e676; 5.107aba69b611007e11b9b93118ff8fe88998c3107f, 1c3d9c6bd5b795f3b952b40d574c8e424e14a39b, 625fc704b19cb48d7d269ad54ffffb4d3bf9c7ed, 57d503ce32eccfa7650065ca4c560f7e29a2e676

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
AdjacentThe attacker must be on the same local network segment.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate extension-frame layout before RX Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can still reach helpers and interface dispatch code that read regular header address fields before unsupported extension subtypes are dropped. mac80211 currently only handles S1G beacon extension frames. Drop other extension subtypes before they can reach regular-header RX processing. For S1G beacons, linearize the SKB with the management-frame path and require the fixed S1G beacon header, including optional fixed fields indicated by frame control, before generic RX dispatch. Route S1G beacons through the station/default-link RX path without regular-header station lookup. Avoid regular-header address reads in the mac80211 RX paths that process S1G extension beacons, including accept-frame, duplicate-detection, address-copy, and MLO address-translation paths. Also make ieee80211_get_bssid() length-safe before returning the S1G source-address pointer.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

How developers prevent this class of flaw

  • Consider using language-theoretic security (LangSec) techniques that characterize inputs using a formal language and build recognizers for that language. This effectively requires parsing to be a distinct layer that effectively enforces a boundary between raw input and internal data representations, instead of allowing parser code to be scattered throughout the program, where it could be subject to errors or inconsistencies that create weaknesses.
  • Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).
  • Understand all the potential areas where untrusted inputs can enter the product, including but not limited to: parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, filenames, databases, and any external systems that provide data to the application. Remember that such inputs may be obtained indirectly through API calls.

More Improper Input Validation vulnerabilities (CWE-20)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Improper Input Validation vulnerabilities

Spotted an error? Tell us.