CVE-2025-37973wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation Currently during the multi-link element defragmentation process, the multi-link element length added to the total IEs length when calculating the length of remaining IEs after the multi-link element in cfg80211_defrag_mle(). This could lead to out-of-bounds access if the multi-link element or its corresponding fragment elements are the last elements in the IEs buffer. To address this issue, correctly calculate the remaining IEs length by deducting the multi-link element end offset from total IEs end offset.
- CVSS
- 8.1 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 15, 2026
Affected products
Linux Linux linux:linux (from the name) | 2481b5da9c6b2ee1fde55a1c29eb2ca377145a10 builds before 73dde269a1a43e6b1aa92eba13ad2df58bfdd38e; from 2481b5da9c6b2ee1fde55a1c29eb2ca377145a10 before 9423f6da825172b8dc60d4688ed3d147291c3be9; from 2481b5da9c6b2ee1fde55a1c29eb2ca377145a10 before e1c6d0c6199bd5f4cfc7a66ae7032b6e805f904d; 2481b5da9c6b2ee1fde55a1c29eb2ca377145a10 builds before 023c1f2f0609218103cbcb48e0104b144d4a16dc | CNA record |
linux linux_kernel linux:linux_kernel | from 6.5 before 6.6.91; from 6.7 before 6.12.29; from 6.13 before 6.14.7; 6.15; 6.15; 6.15; 6.15; 6.15 | NVD |
References
- https://git.kernel.org/stable/c/73dde269a1a43e6b1aa92eba13ad2df58bfdd38epatch
- https://git.kernel.org/stable/c/9423f6da825172b8dc60d4688ed3d147291c3be9patch
- https://git.kernel.org/stable/c/e1c6d0c6199bd5f4cfc7a66ae7032b6e805f904dpatch
- https://git.kernel.org/stable/c/023c1f2f0609218103cbcb48e0104b144d4a16dcpatch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.