CVE-2026-64030

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs

IEEE80211_MLE_STA_EPCS_CONTROL_LINK_ID is 0x000f, so link_id extracted

from a PRIO_ACCESS ML element PER_STA_PROFILE subelement can be 0..15.

sdata->link[] has IEEE80211_MLD_MAX_NUM_LINKS (15) entries (indices 0..14),

making index 15 out-of-bounds.

A connected WiFi 7 AP can trigger this by sending an EPCS Enable Response

action frame with a PER_STA_PROFILE subelement where link_id = 15. The

unsolicited-notification path (dialog_token = 0) is reachable any time

EPCS is already enabled, without any prior client request.

sdata->link[15] reads into the first word of sdata->activate_links_work

(a wiphy_work whose embedded list_head is non-NULL after INIT_LIST_HEAD),

so the NULL check on the result does not catch the invalid access. The

garbage pointer is then passed to ieee80211_sta_wmm_params(), which

dereferences link->sdata and crashes the kernel.

The same class of bug was fixed for ieee80211_ml_reconfiguration() by

commit 162d331d833d ("wifi: mac80211: bounds-check link_id in

ieee80211_ml_reconfiguration").