CVE-2026-68407: wifi: nl80211: free RNR data on MBSSID mismatch

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

wifi: nl80211: free RNR data on MBSSID mismatch

nl80211_parse_beacon() rejects EMA RNR data when there are fewer RNR
entries than MBSSID entries.

The rejected RNR allocation has not been attached to the beacon data yet,
so free it before returning the error.

The Linux kernel CVE team has assigned CVE-2026-68407 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.4 with commit dbbb27e183b1568d5a907ace1cd144b0709ea52a and fixed in 6.6.148 with commit fa9592ef7de11f8c7042315d9bc20e91a97f679e
	Issue introduced in 6.4 with commit dbbb27e183b1568d5a907ace1cd144b0709ea52a and fixed in 6.12.101 with commit 312c8b9d7836ef58e552619a8c19be08b04032bb
	Issue introduced in 6.4 with commit dbbb27e183b1568d5a907ace1cd144b0709ea52a and fixed in 6.18.42 with commit fb052a6e2fa866384d8edc237746583ec94c15af
	Issue introduced in 6.4 with commit dbbb27e183b1568d5a907ace1cd144b0709ea52a and fixed in 7.1.6 with commit 6f919f29e9b75793104709987131b8d910d7800a
	Issue introduced in 6.4 with commit dbbb27e183b1568d5a907ace1cd144b0709ea52a and fixed in 7.2-rc4 with commit 07a95ec2b54774201fdf4ef7ffb0ca2ab19ed29c
	Issue introduced in 6.1.160 with commit 56189d7bc30531def6b999f27940ee43c6ff2569

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68407
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/wireless/nl80211.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/fa9592ef7de11f8c7042315d9bc20e91a97f679e
	https://git.kernel.org/stable/c/312c8b9d7836ef58e552619a8c19be08b04032bb
	https://git.kernel.org/stable/c/fb052a6e2fa866384d8edc237746583ec94c15af
	https://git.kernel.org/stable/c/6f919f29e9b75793104709987131b8d910d7800a
	https://git.kernel.org/stable/c/07a95ec2b54774201fdf4ef7ffb0ca2ab19ed29c