Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2026-53182

wifi: nl80211: reject oversized EMA RNR lists

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: reject oversized EMA RNR lists nl80211_parse_rnr_elems() stores the parsed element count in a u8-backed cfg80211_rnr_elems::cnt field and uses that count to size the flexible array allocation. Reject nested NL80211_ATTR_EMA_RNR_ELEMS input once the count reaches 255, before incrementing it again. This keeps the parser aligned with the data structure it fills and matches the existing bound check used by nl80211_parse_mbssid_elems().

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 56189d7bc30531def6b999f27940ee43c6ff2569 to < fc0ec2fc02dfe52c5821f36fbccf6a45df43f508affected
  • dbbb27e183b1568d5a907ace1cd144b0709ea52a to < 688fcac7054abc680c0eef753f2bb772cfaf8cf7affected
  • dbbb27e183b1568d5a907ace1cd144b0709ea52a to < 30c3fa80f423613efdda3deca4af52ff7d20e4e2affected
  • dbbb27e183b1568d5a907ace1cd144b0709ea52a to < 265c07c09c837621730d35f02975207a1224bf05affected
  • dbbb27e183b1568d5a907ace1cd144b0709ea52a to < ecbf3c45add30a0857414e156bdb9c79906f0ff6affected
  • dbbb27e183b1568d5a907ace1cd144b0709ea52a to < 4cd92957e8f8cc4ebfe8a5d4203c14c592fde6b1affected
  • 6.1.160 to < 6.1.176affected

Linux Linux

Default version status: affected

  • 6.4affected
  • 0 to < 6.4unaffected
  • 6.1.176 to ≤ 6.1.*unaffected
  • 6.6.143 to ≤ 6.6.*unaffected
  • 6.12.94 to ≤ 6.12.*unaffected
  • 6.18.36 to ≤ 6.18.*unaffected
  • 7.0.13 to ≤ 7.0.*unaffected
  • 7.1 to ≤ *unaffected

References