CVE-2026-68407

A flaw was found in the Linux kernel's Wi-Fi subsystem (nl80211). When processing beacon frames, the nl80211_parse_beacon() function may fail to properly free allocated RNR (Reduced Neighbor Report) data if there is a mismatch in the number of RNR and MBSSID (Multiple Basic Service Set Identifier) entries. This improper memory handling could lead to a memory leak, potentially allowing a remote attacker to cause a denial of service.

This issue affects nl80211 beacon parsing with EMA MBSSID and RNR data. When RNR entries are fewer than MBSSID entries, the rejected RNR allocation is not freed before returning the error. Systems not using nl80211 beacon parsing are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.