CVE-2026-64030: wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs

IEEE80211_MLE_STA_EPCS_CONTROL_LINK_ID is 0x000f, so link_id extracted
from a PRIO_ACCESS ML element PER_STA_PROFILE subelement can be 0..15.
sdata->link[] has IEEE80211_MLD_MAX_NUM_LINKS (15) entries (indices 0..14),
making index 15 out-of-bounds.

A connected WiFi 7 AP can trigger this by sending an EPCS Enable Response
action frame with a PER_STA_PROFILE subelement where link_id = 15.  The
unsolicited-notification path (dialog_token = 0) is reachable any time
EPCS is already enabled, without any prior client request.

sdata->link[15] reads into the first word of sdata->activate_links_work
(a wiphy_work whose embedded list_head is non-NULL after INIT_LIST_HEAD),
so the NULL check on the result does not catch the invalid access.  The
garbage pointer is then passed to ieee80211_sta_wmm_params(), which
dereferences link->sdata and crashes the kernel.

The same class of bug was fixed for ieee80211_ml_reconfiguration() by
commit 162d331d833d ("wifi: mac80211: bounds-check link_id in
ieee80211_ml_reconfiguration").

The Linux kernel CVE team has assigned CVE-2026-64030 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.15 with commit de86c5f60839dc0d771711a848b4f55ad3f90844 and fixed in 6.18.34 with commit 2d8379834800c30602f24c71ab7c40f5fe84d200
	Issue introduced in 6.15 with commit de86c5f60839dc0d771711a848b4f55ad3f90844 and fixed in 7.0.11 with commit 863f1f02a3bd70dbd857b8ac4070292fde8cb4e2
	Issue introduced in 6.15 with commit de86c5f60839dc0d771711a848b4f55ad3f90844 and fixed in 7.1 with commit f718506edd2d9c6a308ded9d13c632bf7b7d5a2c

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64030
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/mac80211/mlme.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/2d8379834800c30602f24c71ab7c40f5fe84d200
	https://git.kernel.org/stable/c/863f1f02a3bd70dbd857b8ac4070292fde8cb4e2
	https://git.kernel.org/stable/c/f718506edd2d9c6a308ded9d13c632bf7b7d5a2c