CVE-2026-68402

A flaw was found in the Linux kernel's Wi-Fi subsystem (cfg80211). The cfg80211_is_element_inherited() function does not properly validate the length of extension elements. A remote attacker, by sending a specially crafted Wi-Fi frame from an Access Point (AP), could trigger a one-octet slab-out-of-bounds read during element parsing. This could lead to information disclosure or potentially other impacts.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploitation requires wireless networking hardware and radio proximity to a rogue access point. Most enterprise server deployments do not utilize Wi-Fi interfaces, greatly restricting the attack surface in standard production environments. On affected client or edge devices, an untrusted wireless access point can trigger a single-byte read beyond buffer boundaries during frame parsing, potentially causing a system crash or limited kernel information disclosure rather than arbitrary code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, disable the Wi-Fi functionality if it is not required. This can be done by blacklisting the cfg80211 kernel module.

1. Create a new file /etc/modprobe.d/disable-wifi.conf with the following content:

blacklist cfg80211

2. Rebuild the initial ramdisk:

sudo dracut -f -v

3. Reboot the system for the changes to take effect.

This mitigation will prevent the cfg80211 module, and thus Wi-Fi, from loading. This may impact network connectivity if Wi-Fi is the primary or only network interface.