HIGH Introduced in 2.6.32
cfg80211 CipherSuite Overflow
CVE-2026-97518
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: reject duplicate wiphy cipher suite entries Duplicate entries in wiphy->cipher_suites do not describe any additional capability, but cfg80211 currently accepts them and leaves individual consumers to deal with them. One such consumer is the WEXT compatibility code, which appends a WEP key length for each WEP cipher entry it sees. Repeated WEP entries can therefore overflow the fixed iw_range::encoding_size array returned by SIOCGIWRANGE. Reject duplicate cipher suite entries in wiphy_register() instead. This keeps the cipher suite invariant in one place and makes malformed wiphy descriptions fail early with -EINVAL, rather than relying on a single cfg80211 user to handle duplicates correctly.
02KernelScan AI Analysis
Risk summary
A local user with access to a WiFi network device can trigger a stack buffer overflow in the kernel's WEXT compatibility layer if the underlying WiFi driver has registered duplicate WEP cipher suite entries. The overflow corrupts a fixed-size array on the kernel stack, potentially leading to code execution or a system crash. The fix rejects malformed wiphy descriptions at registration time, preventing the overflow from occurring.
Vulnerability analysis
When a WiFi driver registers its wireless PHY device, the kernel does not check whether the list of supported cipher suites contains duplicates. The WEXT compatibility layer iterates over every WEP cipher entry and appends a key length to a fixed-size array; duplicate WEP entries therefore write past the end of that array, corrupting adjacent kernel stack memory. The overflow is triggered when any local user issues the SIOCGIWRANGE ioctl on a wireless device whose driver supplied duplicate cipher suites. The fix adds a validation step during wiphy registration that rejects any description containing duplicate cipher suite entries, returning an error before the device becomes usable, so the WEXT code never encounters the overflow condition.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 2.6.32 | 6.12.111 | 1305f8b925fe |
| 6.18 | 2.6.32 | 6.18.53 | 4cbb2360f4d8 |
| 6.6 | 2.6.32 | 6.6.160 | d12e92e72db9 |
| mainline | 2.6.32 | 7.2 | 7187d145d904 |
| cip/6.12 | 2.6.32 | 6.12.111-cip32 | 1305f8b925fe |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Affected — no CIP fix yet (latest 6.1.189-cip61) |
| cip/6.1-rt | Affected — no CIP fix yet (latest 6.1.189-cip61-rt32) |
| cip/5.10 | Affected — no CIP fix yet (latest 5.10.271-cip78) |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |
| cip/4.4 | Affected — no CIP fix yet (latest 4.4.302-cip115) |
| cip/4.4-rt | Affected — no CIP fix yet (latest 4.4.302-cip115-rt63) |