CVE-2026-64174

In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: advance loop vars in cfg80211_merge_profile()

cfg80211_merge_profile() reassembles a Multi-BSSID non-transmitted BSS

profile that has been split across multiple consecutive MBSSID elements.

Its while-loop calls

cfg80211_get_profile_continuation(ie, ielen, mbssid_elem, sub_elem)

but never advances mbssid_elem or sub_elem inside the body. Each

iteration therefore searches for a continuation that follows the same

fixed pair; the helper returns the same next_mbssid; and the same

next_sub bytes are memcpy()'d into merged_ie at a growing offset until

the buffer fills.

Advance both mbssid_elem and sub_elem to the just-consumed continuation

so the next call to cfg80211_get_profile_continuation() searches for a

further continuation beyond it (or returns NULL when none exists).

A specially-crafted malicious beacon can take advantage of this bug

to cause the kernel to spend an excessive amount of time in

cfg80211_merge_profile (up to as much as 2ms per beacon received),

which could theoretically be abused in some way.