CVE-2026-64515

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: mac80211: fix MLE defragmentation<br /> <br /> If either reconf or EPCS multi-link element (MLE) is contained in<br /> a non-transmitted profile, the defragmentation routine is called<br /> with a pointer to the defragmented copy, but the original elements.<br /> <br /> This is incorrect for two reasons:<br /> - if the original defragmentation was needed, it will not find the<br /> correct data<br /> - if the original frame is at a higher address, the parsing will<br /> potentially overrun the heap data (though given the layout of<br /> the buffers, only into the new defragmentation buffer, and then<br /> it has to stop and fail once that&amp;#39;s filled with copied data.<br /> <br /> Fix it by tracking the container along with the pointer and in<br /> doing so also unify the two almost identical defragmentation<br /> routines.