CVE-2026-97517

A flaw was found in the Linux kernel's nl80211 wireless configuration interface. This flaw can lead to a Denial of Service (DoS) caused by an out-of-bounds memory read when processing wireless beacon settings. The kernel fails to validate that the variable-length portion of a High Efficiency (HE) operation element is within expected bounds. A local user can exploit this vulnerability by submitting a malformed beacon configuration to crash the operating system.

A flaw of moderate impact was found in the Linux kernel's nl80211 wireless configuration interface. When processing access point beacon settings, the kernel checked only that a High Efficiency (HE) operation element was longer than its fixed part, but did not verify that the element's variable-length portion was fully present. A local attacker with the privileges required to configure wireless access point beacons (CAP_NET_ADMIN) could submit a malformed beacon configuration containing a truncated HE operation element, triggering an out-of-bounds memory read that can crash the kernel and cause a denial of service. Confidentiality and integrity are not impacted. This issue affects the kernel in Red Hat Enterprise Linux 8, 9, and 10 (including kernel-rt), Red Hat In-Vehicle OS 2, and OpenShift Container Platform 4 and 5 through the RHEL CoreOS kernels. Red Hat Enterprise Linux 7 is not affected because the vulnerable code is not present in those streams. The issue is not directly reachable through normal over-the-air Wi-Fi traffic, as it resides in the local access point control-plane configuration path. The Red Hat severity of Moderate (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects the local privileged access required for exploitation. Fixes for the affected streams are currently deferred to a future update; the residual risk is limited to local denial of service by an attacker who already holds wireless network administration privileges on the system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.