CVE-2026-64030

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs<br /> <br /> IEEE80211_MLE_STA_EPCS_CONTROL_LINK_ID is 0x000f, so link_id extracted<br /> from a PRIO_ACCESS ML element PER_STA_PROFILE subelement can be 0..15.<br /> sdata-&gt;link[] has IEEE80211_MLD_MAX_NUM_LINKS (15) entries (indices 0..14),<br /> making index 15 out-of-bounds.<br /> <br /> A connected WiFi 7 AP can trigger this by sending an EPCS Enable Response<br /> action frame with a PER_STA_PROFILE subelement where link_id = 15. The<br /> unsolicited-notification path (dialog_token = 0) is reachable any time<br /> EPCS is already enabled, without any prior client request.<br /> <br /> sdata-&gt;link[15] reads into the first word of sdata-&gt;activate_links_work<br /> (a wiphy_work whose embedded list_head is non-NULL after INIT_LIST_HEAD),<br /> so the NULL check on the result does not catch the invalid access. The<br /> garbage pointer is then passed to ieee80211_sta_wmm_params(), which<br /> dereferences link-&gt;sdata and crashes the kernel.<br /> <br /> The same class of bug was fixed for ieee80211_ml_reconfiguration() by<br /> commit 162d331d833d ("wifi: mac80211: bounds-check link_id in<br /> ieee80211_ml_reconfiguration").