CVE-2026-64515: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-64515 is a heap buffer overread vulnerability in the Linux kernel's mac80211 Wi-Fi subsystem, specifically in the Multi-Link Element (MLE) defragmentation routine. The flaw was published on July 25, 2026, and affects Linux kernel versions from 6.9 up to (but not including) the patched stable releases. Fixed versions include 6.12.92, 6.18.34, 7.0.11, and 7.1. The CVSS score has not been formally assigned, but Feedly estimates the severity as Medium (GitHub Advisory, Feedly).

The root cause is an incorrect pointer handling in the mac80211 MLE defragmentation routine (CWE not formally assigned; consistent with CWE-125: Out-of-bounds Read). When a reconf or EPCS multi-link element is contained in a non-transmitted profile, the defragmentation function is called with a pointer to the defragmented copy but is passed the original (non-defragmented) elements. This causes two failure modes: if defragmentation was originally needed, the routine cannot locate the correct data; and if the original frame resides at a higher memory address, the parser may overread heap memory into the new defragmentation buffer before halting. The fix tracks the container alongside the pointer and unifies the two near-identical defragmentation routines (GitHub Advisory, Feedly).

Successful exploitation allows an unauthenticated attacker within wireless range to trigger a heap buffer overread during 802.11 MLE defragmentation processing, potentially disclosing sensitive kernel memory contents. The primary impact is a confidentiality breach — kernel memory may be leaked to an attacker — while integrity and availability are not directly affected under normal exploitation conditions. The scope is limited to Linux systems with Wi-Fi interfaces using the mac80211 subsystem that are exposed to untrusted wireless networks (Feedly).

Update the Linux kernel to a patched version: 6.12.92, 6.18.34, 7.0.11, or 7.1 and later. The corresponding upstream fix commits are 1f573e17bcb7, 55c479aae99b, 722b3f86df80, and a74e893f30db (GitHub Advisory). If immediate patching is not feasible, restrict wireless interface exposure to trusted networks and implement network segmentation to reduce the attack surface of Wi-Fi-enabled Linux systems (Feedly).