CVE-2026-64223

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds read exists in the mac80211 module of the Linux kernel. The ieee80211 parse neg ttlm() function incorrectly advances its cursor for every Traffic Identifier (TID), regardless of whether the presence bit is clear. In cases of sparse maps, this allows a subsequent present TID to read data beyond the validated element. The resulting data is stored in neg ttlm->{up,down}link[tid], but is gated by valid links before affecting driver state, preventing a peer from altering policies. This issue manifests as a slab-out-of-bounds read under specific memory allocation states.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.