LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23152: wifi: mac80211: correctly decode TTLM with default link map

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: correctly decode TTLM with default link map TID-To-Link Mapping (TTLM) elements do not contain any link mapping presence indicator if a default mapping is used and parsing needs to be skipped. Note that access points should not explicitly report an advertised TTLM with a default mapping as that is the implied mapping if the element is not included, this is even the case when switching back to the default mapping. However, mac80211 would incorrectly parse the frame and would also read one byte beyond the end of the element.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel Wi-Fi parsing flaw in mac80211. A malformed or unexpected TTLM element with default mapping could make the kernel read one byte past the element. The source bundle does not provide CVSS, business impact, or exploitation evidence, so urgency should be driven by wireless exposure and vendor kernel guidance.

Executive priority

Treat as a targeted kernel maintenance item, not an emergency, unless critical Linux assets rely on affected Wi-Fi functionality. Prioritize confirmation and patch planning because impact and exploitation evidence are incomplete in the available sources.

Technical view

mac80211 incorrectly decodes TID-To-Link Mapping elements when default link mapping is used. The resolved issue says parsing should be skipped because no mapping presence indicator exists. The previous behavior could read one byte beyond the element boundary. Upstream stable kernel commits are referenced as fixes.

Likely exposure

Likely exposure is Linux systems running affected kernel versions or downstream builds that include the vulnerable mac80211 Wi-Fi code. Exact distro, appliance, and endpoint exposure requires vendor kernel mapping because the bundle lists upstream Linux versions and commit identifiers only.

Exploitation context

The bundle does not cite CISA KEV listing, active exploitation, public exploit code, or observed attacks. The described condition is frame parsing of TTLM elements, but the provided evidence does not establish exploitability beyond a one-byte out-of-bounds read.

Researcher notes

Key evidence is the upstream resolution text: default TTLM mapping should skip parsing, but mac80211 parsed it and read one byte past the element. No CWE, CVSS, exploit status, or detailed affected downstream product matrix is provided.

Mitigation direction

  • Check Linux vendor advisories for CVE-2026-23152 applicability.
  • Update to a kernel containing the referenced stable fixes.
  • Prioritize wireless-enabled Linux endpoints and appliances.
  • Confirm downstream distro kernels have backported the fix.
  • If no vendor fix exists, monitor guidance and reduce unnecessary Wi-Fi exposure.

Validation and detection

  • Inventory Linux kernel versions on wireless-enabled systems.
  • Map distro package versions to upstream fixed commits.
  • Review whether mac80211 Wi-Fi functionality is enabled or used.
  • Confirm patch status through vendor advisory or changelog.
  • Record unsupported or unclear systems for follow-up review.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23152 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux702e80470a3359ce02b3f846f48f6db4ac7fd837, 702e80470a3359ce02b3f846f48f6db4ac7fd837unaffected
LinuxLinux6.7, 0, 6.18.9, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.