CVE-2026-68412

A flaw was found in the Linux kernel's Wi-Fi subsystem, specifically within the cfg80211 component. This vulnerability, located in the cfg80211_wext_siwscan() function, can lead to a memory leak. A local attacker could exploit this by sending a crafted Wi-Fi scan request with an Extended Service Set Identifier (ESSID) exceeding the maximum allowed length. This improper handling of the oversized ESSID causes a creq object to not be properly freed, potentially leading to a denial of service.

This issue affects cfg80211 wireless extensions scan requests. If SSID length validation fails in cfg80211_wext_siwscan(), the allocated creq structure leaks. Systems using only nl80211 (not wext) are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.