CyberSecBulletin
CVE-2026-68472NVD status: Received

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2026-68472 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 8.1 out of 10. It can be exploited from the same local network by an unauthenticated attacker, without any action from a user. The record lists versions 584657c5fc58d7a840623a2fa06331c9661dd0f1, 3b0505e43da8fb5b2a7994c3c3604e5a74692154, 74e27cd1d98b546fdb276008a83708d062339661 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.34% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 584657c5fc58d7a840623a2fa06331c9661dd0f1 or 3b0505e43da8fb5b2a7994c3c3604e5a74692154 or 74e27cd1d98b546fdb276008a83708d062339661, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux61dcfa8c2a8f6c53ce77b2c832b82990754b2aa9 up to, but not including, 584657c5fc58d7a840623a2fa06331c9661dd0f1; 61dcfa8c2a8f6c53ce77b2c832b82990754b2aa9 up to, but not including, 3b0505e43da8fb5b2a7994c3c3604e5a74692154; 61dcfa8c2a8f6c53ce77b2c832b82990754b2aa9 up to, but not including, 74e27cd1d98b546fdb276008a83708d062339661; 6.14584657c5fc58d7a840623a2fa06331c9661dd0f1, 3b0505e43da8fb5b2a7994c3c3604e5a74692154, 74e27cd1d98b546fdb276008a83708d062339661

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
AdjacentThe attacker must be on the same local network segment.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate EHT MLE before MLD ID read cfg80211_gen_new_ie() copies ML probe response elements from the parent frame when the parent EHT multi-link element has an MLD ID matching the nontransmitted BSSID index. The code only checked that the extension element had more than one byte before calling ieee80211_mle_get_mld_id(). That helper assumes a BASIC MLE with enough common info and documents that callers must first use ieee80211_mle_type_ok(). Attack chain: malicious AP sends a short EHT MLE in an MBSSID beacon. cfg80211_inform_bss_frame_data() stores the copied IE buffer. cfg80211_parse_mbssid_data() builds the nontransmitted BSS IE. cfg80211_gen_new_ie() sees the EHT MLE in the parent frame. ieee80211_mle_get_mld_id() then reads past the IE boundary. Validate the MLE type and size before reading the MLD ID. This matches the contract required by the MLE helper and rejects the short element before any internal MLE fields are accessed.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.