Bug 2492722 (CVE-2026-53182) - CVE-2026-53182 kernel: wifi: nl80211: reject oversized EMA RNR lists
Summary: CVE-2026-53182 kernel: wifi: nl80211: reject oversized EMA RNR lists
Keywords:
Status: NEW
Alias: CVE-2026-53182
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-06-25 10:02 UTC by OSIDB Bzimport
Modified: 2026-09-15 00:47 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:65334 0 None None None 2026-09-08 11:35:12 UTC
Red Hat Product Errata RHSA-2026:67150 0 None None None 2026-09-14 13:36:03 UTC
Red Hat Product Errata RHSA-2026:67468 0 None None None 2026-09-15 00:47:03 UTC
Red Hat Product Errata RHSA-2026:67469 0 None None None 2026-09-15 00:24:49 UTC

Description OSIDB Bzimport 2026-06-25 10:02:21 UTC 
In the Linux kernel, the following vulnerability has been resolved:

wifi: nl80211: reject oversized EMA RNR lists

nl80211_parse_rnr_elems() stores the parsed element count in a
u8-backed cfg80211_rnr_elems::cnt field and uses that count to size
the flexible array allocation.

Reject nested NL80211_ATTR_EMA_RNR_ELEMS input once the count reaches
255, before incrementing it again. This keeps the parser aligned with
the data structure it fills and matches the existing bound check used
by nl80211_parse_mbssid_elems().
Comment 1 TEJ RATHI 2026-06-26 07:55:48 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026062555-CVE-2026-53182-1e3e@gregkh/T
Comment 5 errata-xmlrpc 2026-09-08 11:35:11 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:65334 https://access.redhat.com/errata/RHSA-2026:65334
Comment 6 Jon Orris 2026-09-14 13:36:02 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:67150 https://access.redhat.com/errata/RHSA-2026:67150
Comment 7 Jon Orris 2026-09-15 00:24:47 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:67469 https://access.redhat.com/errata/RHSA-2026:67469
Comment 8 Jon Orris 2026-09-15 00:47:01 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:67468 https://access.redhat.com/errata/RHSA-2026:67468
Note You need to log in before you can comment on or make changes to this bug.