CVE-2026-68402

This CVE targets cfg80211_is_element_inherited(), a function that determines whether an element should inherit properties from a parent context. The out-of-bounds read triggers only during Multi-Link Operation (802.11be) or non-transmitted BSS profile parsing — contexts that activate a code path the function's original design never anticipated. Specifically, a zero-length extension element (WLAN_EID_EXTENSION with length 0) slips past existing validation because the non-inheritance checking branch was never audited against empty extension elements, only against empty ID lists. The fix mirrors existing empty-ID-list handling: treat zero-length extension elements as inherited. This is the correct defensive posture, but the pattern is telling — the codebase had the right guard for one empty-case, and the extension-element branch simply wasn't checked against it when Multi-Link Operation added this parsing path. That's incomplete pattern application, not combinatorial explosion. The downstream risk is the real concern. In 802.11be MLO, a client maintains one logical connection across multiple radio links. Per-STA profiles carry link-specific configuration — traffic parameters, power save coordination, band-specific capabilities. When a zero-length extension element is silently treated as inherited, the client falls through to default or inherited values that may not match what the AP configured for that specific link. The links aren't independent; the client makes scheduling and txop decisions across bands assuming coherent state. A silent inheritance failure creates incoherence across the multi-link aggregate that may manifest as intermittent performance issues rather than an obvious error. With Wi-Fi 7 deployments accelerating, this attack surface is moving from theoretical to practical. A malicious or compromised AP can trigger this against any client. The fuzzer found it under KASAN — but an OOB read that returns garbage and causes incorrect inheritance decisions is a silent corruption, not always a crash. The fix closes the immediate vulnerability, but the architectural question remains: what other element-type × non-inheritance-context combinations in this parser haven't been systematically fuzzed? The lineage of empty-payload element bugs in kernel Wi-Fi — fragment handling, vendor elements, now extension elements — suggests this is a pattern, not an isolated incident. Check whether your cfg80211 builds have this patch applied. If you're deploying Wi-Fi 7 clients, treat the attack surface as active: a compromised or malicious AP within radio range can trigger this against vulnerable clients. Beyond patching, audit other element-parsing functions in cfg80211 that may have accumulated new responsibility from MLO without corresponding guard audits. The question isn't whether this specific bug exists — it's whether other intersections between legacy parsing assumptions and new protocol contexts remain undiscovered.

Reviewed through automated stages and approved by a human before publication.