CVE-2026-64030

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds access occurs in the ieee80211 ml epcs() function when processing a PRIO ACCESS ML element PER STA PROFILE subelement. A connected WiFi 7 AP can trigger this by sending an EPCS Enable Response action frame where the link id is set to 15. Since the sdata->link[] array only contains 15 entries (indices 0 to 14), an index of 15 is out-of-bounds. This results in the system reading into the sdata->activate links work variable, passing a garbage pointer to the ieee80211 sta wmm params() function, which then dereferences it and causes a kernel crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.