CVE-2026-97518wifi: cfg80211: reject duplicate wiphy cipher suite entries
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: reject duplicate wiphy cipher suite entries Duplicate entries in wiphy->cipher_suites do not describe any additional capability, but cfg80211 currently accepts them and leaves individual consumers to deal with them. One such consumer is the WEXT compatibility code, which appends a WEP key length for each WEP cipher entry it sees. Repeated WEP entries can therefore overflow the fixed iw_range::encoding_size array returned by SIOCGIWRANGE. Reject duplicate cipher suite entries in wiphy_register() instead. This keeps the cipher suite invariant in one place and makes malformed wiphy descriptions fail early with -EINVAL, rather than relying on a single cfg80211 user to handle duplicates correctly.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 28, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 2ab658f9ce218ae93b3d2db2b3fe68bfefb81196 before 1305f8b925fe92edf5fec183588dfc7db719180b; from 2ab658f9ce218ae93b3d2db2b3fe68bfefb81196 before 4cbb2360f4d8c29e67bc7a8bf6ba0ae096583923; from 2ab658f9ce218ae93b3d2db2b3fe68bfefb81196 before 7187d145d9042b037e4f10538f70cf95e380219f | CNA record |
References
- https://git.kernel.org/stable/c/1305f8b925fe92edf5fec183588dfc7db719180b
- https://git.kernel.org/stable/c/4cbb2360f4d8c29e67bc7a8bf6ba0ae096583923
- https://git.kernel.org/stable/c/7187d145d9042b037e4f10538f70cf95e380219f
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.