CVE-2026-78807: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-78807 is an origin validation error in wpa_supplicant that allows a local attacker to bypass proper network context and AKMP (Authentication and Key Management Protocol) matching for PMKSA (Pairwise Master Key Security Association) caching. The flaw exists in the driver-based PMKSA selection path within wpa.c and affects all versions of wpa_supplicant before v2.12. It was published on September 11, 2026, with a patch available in v2.12. The vulnerability carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory).

The root cause is classified as CWE-346 (Origin Validation Error): the software does not properly verify that the source of data or communication is valid. Specifically, the driver-based PMKSA cache selection path in wpa.c lacks validation to ensure that a cached PMKSA entry matches the correct network context and AKMP type before use. This allows a local, low-privileged attacker to manipulate PMKSA cache selection without requiring user interaction, potentially causing the supplicant to associate with an unintended network using a mismatched security context. The official vendor advisory is available at the w1.fi security page (GitHub Advisory).

Successful exploitation allows a local attacker to bypass authentication mechanisms enforced by PMKSA caching, potentially enabling connection to unintended or malicious wireless networks without proper credential validation. The CVSS assessment indicates high impact on both confidentiality and integrity, as an attacker could intercept or manipulate network traffic by forcing the supplicant to use an incorrect PMKSA entry. Availability is not directly impacted. The attack is limited to the local system context and does not enable remote exploitation (GitHub Advisory).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been observed as of the disclosure date (GitHub Advisory). The NVD SSVC assessment classifies the vulnerability as non-automatable with no known exploitation. The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges, limiting the attack surface.

The primary remediation is to update wpa_supplicant to version 2.12 or later, which includes the fix for the missing PMKSA cache validation (GitHub Advisory). Until patching is feasible, administrators should restrict local user access to systems running affected versions and monitor for unauthorized or unexpected wireless network association events. Linux distribution maintainers (e.g., Debian) are expected to backport the fix; users should apply distribution-provided security updates as they become available.