CVE-2026-23152: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23152 is an out-of-bounds memory read vulnerability in the Linux kernel's mac80211 WiFi subsystem, specifically in the TID-To-Link Mapping (TTLM) element parser. When a TTLM element uses a default link map, no link mapping presence indicator is included and parsing should be skipped; however, mac80211 incorrectly parses the frame and reads one byte beyond the end of the element. The vulnerability affects Linux kernel versions 6.7 through 6.18.8 and 6.19-rc1 through 6.19-rc7. It was published on February 14, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is an out-of-bounds read (CWE-125) in the mac80211 TTLM parser within the Linux kernel's WiFi stack. When an access point sends a TTLM element advertising a default mapping — which per the 802.11 specification should not include a link mapping presence indicator — mac80211 fails to detect this condition and continues parsing, reading one byte past the end of the element buffer. The attack vector is local (AV:L), requiring low privileges, and no user interaction is needed. Patches have been committed to the stable kernel tree at two separate commits (Kernel Patch 1, Kernel Patch 2).

Successful exploitation results in a denial-of-service condition — specifically a system crash or hang — due to the out-of-bounds memory read. The impact is limited to availability; there is no confidentiality or integrity compromise. Affected systems include any WiFi-enabled Linux host running kernel versions 6.7 through 6.18.8 or 6.19-rc1 through 6.19-rc7 (Feedly).

Update the Linux kernel to version 6.18.9 or later, which includes the fix for this vulnerability. Patches have been committed to the stable kernel tree at commit 1eab33a and commit aabc368. As a temporary workaround, restricting access to untrusted WiFi networks can reduce exposure on systems that cannot be immediately patched (Feedly).