CVE-2026-64174
wifi: cfg80211: advance loop vars in cfg80211_merge_profile()
Description
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: advance loop vars in cfg80211_merge_profile() cfg80211_merge_profile() reassembles a Multi-BSSID non-transmitted BSS profile that has been split across multiple consecutive MBSSID elements. Its while-loop calls cfg80211_get_profile_continuation(ie, ielen, mbssid_elem, sub_elem) but never advances mbssid_elem or sub_elem inside the body. Each iteration therefore searches for a continuation that follows the same fixed pair; the helper returns the same next_mbssid; and the same next_sub bytes are memcpy()'d into merged_ie at a growing offset until the buffer fills. Advance both mbssid_elem and sub_elem to the just-consumed continuation so the next call to cfg80211_get_profile_continuation() searches for a further continuation beyond it (or returns NULL when none exists). A specially-crafted malicious beacon can take advantage of this bug to cause the kernel to spend an excessive amount of time in cfg80211_merge_profile (up to as much as 2ms per beacon received), which could theoretically be abused in some way.
INFO
Published Date :
July 19, 2026, 4:17 p.m.
Last Modified :
July 19, 2026, 4:17 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products
The following products are affected by CVE-2026-64174
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
Solution
- Update the Linux kernel to the latest version.
- Apply the specific patch for cfg80211_merge_profile.
- Verify loop variables are advanced correctly.
- Monitor system stability after the update.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-64174.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-64174 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-64174
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-64174 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-64174 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 19, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'fe806e4992c9047affd263bcc13b2c047029a726', 'lessThan': '5817e1e5205498a5df66eba2b34e817f4210fd0f', 'versionType': 'git'}, {'status': 'affected', 'version': 'fe806e4992c9047affd263bcc13b2c047029a726', 'lessThan': 'cedbb608494ba1e7a5c6c56b7f1d3fd470094f28', 'versionType': 'git'}, {'status': 'affected', 'version': 'fe806e4992c9047affd263bcc13b2c047029a726', 'lessThan': 'c0bc4c8bd556cbe036a5b9ed333c0aab9aadfcb8', 'versionType': 'git'}, {'status': 'affected', 'version': 'fe806e4992c9047affd263bcc13b2c047029a726', 'lessThan': '1ced0f5a851f9cae274545a42a06c459b7fd8881', 'versionType': 'git'}, {'status': 'affected', 'version': 'fe806e4992c9047affd263bcc13b2c047029a726', 'lessThan': '67915715fd3874057457363c87c63e18829527df', 'versionType': 'git'}, {'status': 'affected', 'version': 'fe806e4992c9047affd263bcc13b2c047029a726', 'lessThan': '6cfae4914439878b8acb35c7e3b40096eeb2ad9c', 'versionType': 'git'}, {'status': 'affected', 'version': 'fe806e4992c9047affd263bcc13b2c047029a726', 'lessThan': '1343a480f84b80c1249133a90ef87f8751d65cbb', 'versionType': 'git'}, {'status': 'affected', 'version': 'fe806e4992c9047affd263bcc13b2c047029a726', 'lessThan': '7666dbb1bacc4ba522b96740cba7283d243d16e1', 'versionType': 'git'}], 'programFiles': ['net/wireless/scan.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.2'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.2', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.258', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.209', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.175', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.142', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.92', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.34', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.11', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/wireless/scan.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: advance loop vars in cfg80211_merge_profile() cfg80211_merge_profile() reassembles a Multi-BSSID non-transmitted BSS profile that has been split across multiple consecutive MBSSID elements. Its while-loop calls cfg80211_get_profile_continuation(ie, ielen, mbssid_elem, sub_elem) but never advances mbssid_elem or sub_elem inside the body. Each iteration therefore searches for a continuation that follows the same fixed pair; the helper returns the same next_mbssid; and the same next_sub bytes are memcpy()'d into merged_ie at a growing offset until the buffer fills. Advance both mbssid_elem and sub_elem to the just-consumed continuation so the next call to cfg80211_get_profile_continuation() searches for a further continuation beyond it (or returns NULL when none exists). A specially-crafted malicious beacon can take advantage of this bug to cause the kernel to spend an excessive amount of time in cfg80211_merge_profile (up to as much as 2ms per beacon received), which could theoretically be abused in some way. Added Reference https://git.kernel.org/stable/c/1343a480f84b80c1249133a90ef87f8751d65cbb Added Reference https://git.kernel.org/stable/c/1ced0f5a851f9cae274545a42a06c459b7fd8881 Added Reference https://git.kernel.org/stable/c/5817e1e5205498a5df66eba2b34e817f4210fd0f Added Reference https://git.kernel.org/stable/c/67915715fd3874057457363c87c63e18829527df Added Reference https://git.kernel.org/stable/c/6cfae4914439878b8acb35c7e3b40096eeb2ad9c Added Reference https://git.kernel.org/stable/c/7666dbb1bacc4ba522b96740cba7283d243d16e1 Added Reference https://git.kernel.org/stable/c/c0bc4c8bd556cbe036a5b9ed333c0aab9aadfcb8 Added Reference https://git.kernel.org/stable/c/cedbb608494ba1e7a5c6c56b7f1d3fd470094f28