Bug 2531997 (CVE-2026-78807)
| Summary: | CVE-2026-78807 wpa_supplicant: wpa_supplicant: Security bypass via missing PMKSA validation | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | rhel-process-autobot, watson-tool-maintainers |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in wpa_supplicant. A local attacker can exploit missing validation in the driver-based PMKSA (Pairwise Master Key Security Association) selection path to bypass proper network context and AKMP (Authentication Key Management Protocol) matching for PMKSA caching. This could allow the attacker to gain unauthorized access to cached network credentials.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2532948, 2532949 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-09-11 18:08:38 UTC
|