CVE-2026-64030

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: bounds-check linkid in ieee80211ml_epcs

IEEE80211MLESTAEPCSCONTROLLINKID is 0x000f, so linkid extracted from a PRIOACCESS ML element PERSTAPROFILE subelement can be 0..15. sdata->link[] has IEEE80211MLDMAXNUMLINKS (15) entries (indices 0..14), making index 15 out-of-bounds.

A connected WiFi 7 AP can trigger this by sending an EPCS Enable Response action frame with a PERSTAPROFILE subelement where linkid = 15. The unsolicited-notification path (dialogtoken = 0) is reachable any time EPCS is already enabled, without any prior client request.

sdata->link[15] reads into the first word of sdata->activatelinkswork (a wiphywork whose embedded listhead is non-NULL after INITLISTHEAD), so the NULL check on the result does not catch the invalid access. The garbage pointer is then passed to ieee80211stawmm_params(), which dereferences link->sdata and crashes the kernel.

The same class of bug was fixed for ieee80211mlreconfiguration() by commit 162d331d833d ("wifi: mac80211: bounds-check linkid in ieee80211ml_reconfiguration").