The Linux kernel's mac80211 component had a vulnerability (CVE-2026-74336) in ieee80211_s1g_check_tim() where the end pointer for the TIM element's Partial Virtual Bitmap (PVB) was set incorrectly to two bytes past the element payload. This caused ieee80211_s1g_find_target_block() to potentially read out-of-bounds memory beyond the TIM element, as it loops while (ptr + 1 <= end) and dereferences ptr. The root cause is that the code incorrectly accounted for the element header bytes when tim already pointed to the payload, resulting in an out-of-bounds read of adjacent skb/heap data when the TIM element is last in the frame. The fix involves passing the correct element end pointer as (const u8 *)tim + tim_len.

This vulnerability allows an out-of-bounds read of kernel memory adjacent to the TIM element payload in WiFi frames processed by mac80211. While it does not explicitly state the impact beyond memory disclosure, out-of-bounds reads can potentially lead to information leakage or kernel instability depending on context. There are no known exploits in the wild reported. No CVSS score is provided.

A fix has been applied to the Linux kernel to correct the pointer arithmetic in ieee80211_s1g_check_tim(), preventing the out-of-bounds read. Users should update to the patched kernel version once available. Patch status is not explicitly confirmed in the provided data; check the official Linux kernel advisories or vendor updates for the exact fixed versions and apply updates accordingly.