All vulnerabilities
CVE-2026-97518

Linux: wifi: cfg80211: reject duplicate wiphy cipher suite entries

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.16%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1305f8b925fe92edf5fec183588dfc7db719180bAlso 4cbb2360f4d8c29e67bc7a8bf6ba0ae096583923, 7187d145d9042b037e4f10538f70cf95e380219fCVE List
Published24 Sep 2026Updated 21 Oct 2026CVE List

What fixes it

  • 1305f8b925fe92edf5fec183588dfc7db719180bLinuxCVE List
  • 4cbb2360f4d8c29e67bc7a8bf6ba0ae096583923LinuxCVE List
  • 7187d145d9042b037e4f10538f70cf95e380219fLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: reject duplicate wiphy cipher suite entries

Duplicate entries in wiphy->cipher_suites do not describe any additional capability, but cfg80211 currently accepts them and leaves individual consumers to deal with them.

One such consumer is the WEXT compatibility code, which appends a WEP key length for each WEP cipher entry it sees. Repeated WEP entries can therefore overflow the fixed iw_range::encoding_size array returned by SIOCGIWRANGE.

Reject duplicate cipher suite entries in wiphy_register() instead. This keeps the cipher suite invariant in one place and makes malformed wiphy descriptions fail early with -EINVAL, rather than relying on a single cfg80211 user to handle duplicates correctly.

Text from CVE List

Affected versions 10

  • Linuxaffected: 2ab658f9ce218ae93b3d2db2b3fe68bfefb81196 before d12e92e72db914e1ea777c6f246f6be75985438eCVE List
  • Linuxaffected: 2ab658f9ce218ae93b3d2db2b3fe68bfefb81196 before 1305f8b925fe92edf5fec183588dfc7db719180bCVE List
  • Linuxaffected: 2ab658f9ce218ae93b3d2db2b3fe68bfefb81196 before 4cbb2360f4d8c29e67bc7a8bf6ba0ae096583923CVE List
  • Linuxaffected: 2ab658f9ce218ae93b3d2db2b3fe68bfefb81196 before 7187d145d9042b037e4f10538f70cf95e380219fCVE List
  • Linuxaffected: 2.6.32CVE List
  • Linuxunaffected: all versions before 2.6.32CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2CVE List

References 4