CVE-2026-74336

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds read exists in the ieee80211 s1g check tim() function when parsing the S1G Partial Virtual Bitmap (PVB) of a received Traffic Indication Map (TIM) element. The issue occurs because the function uses an incorrect end sentinel of (const u8 *)tim + tim len + 2, which extends two bytes beyond the actual element payload. Consequently, the ieee80211 s1g find target block() function may read adjacent skb or heap data if the TIM is the final element in the frame.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.