Login Sign Up

CVE-2026-23152

N/A Unknown
Denial of Service Buffer Overflow

📋 TL;DR

A vulnerability in the Linux kernel's mac80211 WiFi subsystem allows attackers to cause a buffer overflow when parsing TID-To-Link Mapping (TTLM) elements with default link maps. This affects Linux systems using WiFi, potentially leading to kernel crashes or arbitrary code execution. The vulnerability is triggered when access points incorrectly include TTLM elements with default mappings.

💻 Affected Systems

Products:
  • Linux kernel
Versions: Specific affected versions not specified in CVE, but patches available in stable kernel trees
Operating Systems: Linux distributions using vulnerable kernel versions
Default Config Vulnerable: ⚠️ Yes
Notes: Vulnerability requires WiFi to be enabled and connected to a malicious or misconfigured access point.

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:
  1. Review the CVE details at NVD
  2. Check vendor security advisories for your specific version
  3. Test if the vulnerability is exploitable in your environment
  4. Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic, system crash, or potential arbitrary code execution in kernel space leading to complete system compromise.

🟠

Likely Case

Kernel crash or denial of service affecting WiFi connectivity on affected systems.

🟢

If Mitigated

Limited impact with proper network segmentation and WiFi security controls in place.

🌐 Internet-Facing: MEDIUM - Requires WiFi connectivity but could be exploited by rogue access points or attackers within WiFi range.
🏢 Internal Only: MEDIUM - Internal WiFi networks could be targeted by malicious actors with network access.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ✅ No
Complexity: MEDIUM

Exploitation requires WiFi connectivity and ability to send crafted TTLM elements, likely requiring proximity or network access.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Patches available in stable kernel trees (commits 1eab33aa63c993685dd341e03bd5b267dd7403fa and aabc36857bd39da65fe2d047bfaf63a0a09917d4)

Vendor Advisory: https://git.kernel.org/stable/c/1eab33aa63c993685dd341e03bd5b267dd7403fa

Restart Required: No

Instructions:

1. Update Linux kernel to patched version from official distribution repositories. 2. For custom kernels, apply patches from kernel.org stable trees. 3. Rebuild and install kernel if compiling from source.

🔧 Temporary Workarounds

Disable WiFi or use wired connections

all

Temporarily disable WiFi interfaces to prevent exploitation until patched

sudo ip link set wlan0 down
sudo nmcli radio wifi off

Restrict WiFi networks

all

Only connect to trusted, secure WiFi networks with known access points

🧯 If You Can't Patch

  • Implement strict WiFi network policies allowing only trusted access points
  • Use network segmentation to isolate WiFi networks from critical systems

🔍 How to Verify

Check if Vulnerable:

Check kernel version and compare with patched versions from distribution vendor. Vulnerable if using unpatched kernel with WiFi enabled.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes the fix commits or check with distribution's security update verification tools.

📡 Detection & Monitoring

Log Indicators:

  • Kernel panic logs
  • WiFi subsystem crash messages in dmesg
  • Unexpected WiFi disconnections

Network Indicators:

  • Unusual TTLM element traffic on WiFi networks
  • Malformed 802.11 management frames

SIEM Query:

source="kernel" AND ("panic" OR "Oops" OR "mac80211" OR "TTLM")

📊 Metadata

CVE ID: CVE-2026-23152
CVSS v3 Score: N/A (Unknown)
Published: February 14, 2026
Last Updated: February 18, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON