8.8

CVE-2026-23246: linux Improper Validation of Array Index

CVSS: 8.8v3.1HighAnalyzed
AliasesUBUNTU-CVE-2026-23246DEBIAN-CVE-2026-23246
Published 18-03-2026Last modified 05-08-2026
Open JSON

Vulnerability summary

CVE-2026-23246 is a high (CVSS 8.8) Improper Validation of Array Index vulnerability in linux. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 21.7% of scored vulnerabilities.

Overall risk
35/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.30%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 16 · Related 16
SUSE-SU-2026:21834-1SUSE-SU-2026:2238-1USN-8567-1USN-8574-1USN-8574-2USN-8574-3

Timeline

  1. 18-03-2026
    PublishedVulnerability first disclosed.
  2. 05-08-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration link_id is taken from the ML Reconfiguration element (control & 0x000f), so it can be 0..15. link_removal_timeout[] has IEEE80211_MLD_MAX_NUM_LINKS (15) elements, so index 15 is out-of-bounds. Skip subelements with link_id >= IEEE80211_MLD_MAX_NUM_LINKS to avoid a stack out-of-bounds write.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.30%

Chance of exploitation in the next 30 days

Percentile

22%

Versus all other CVEs

30-day change

+0.01 pp

From 0.29% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.30%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu130 products
  • linux< 6.8.0-136.136 | All versions (No fix recorded)
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 6.8.0-1061.64 | All versions (No fix recorded)
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 8eb8dd2ffbbb6b0b8843b66754ee9f129f1b2d6c, < 650981e718e68005ca2760a6358134b8a98ebea4 | ≥ 8eb8dd2ffbbb6b0b8843b66754ee9f129f1b2d6c, < bfde158d5d1322c0c2df398a8d1ccce04943be2e | ≥ 8eb8dd2ffbbb6b0b8843b66754ee9f129f1b2d6c, < f35ceec54d48e227fa46f8f97fd100a77b8eab15 | ≥ 8eb8dd2ffbbb6b0b8843b66754ee9f129f1b2d6c, < d58d71c2167601762351962b9604808d3be94400 | ≥ 8eb8dd2ffbbb6b0b8843b66754ee9f129f1b2d6c, < 162d331d833dc73a3e905a24c44dd33732af1fc5 | 6.5
  • linux_kernelEOL≥ 6.5.1, < 6.6.130 | ≥ 6.7, < 6.12.77 | ≥ 6.13, < 6.18.17 | ≥ 6.19, < 6.19.7 | 6.5 | 7.0:rc1
Debian1 product
  • linux< 6.12.85-1 | < 6.19.8-1

3 vendors · 133 products

References

24 links
Show all 24 references