CVE-2026-23246 is a vulnerability in the Linux kernel's mac80211 WiFi subsystem where the link_id index, derived from the ML Reconfiguration element, was not properly bounds-checked. The link_id can range from 0 to 15, but the link_removal_timeout array has only 15 elements (indexed 0 to 14), causing an out-of-bounds stack write when link_id equals 15. This flaw could lead to memory corruption and potentially compromise system integrity. The issue affects multiple Linux kernel versions prior to 6.8.0 and related Ubuntu kernel builds. The vulnerability has a CVSS 3.1 score of 8.8 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Ubuntu has released patches addressing this and other kernel vulnerabilities in their USN-8567-1 and USN-8574-1 advisories.

Successful exploitation of this vulnerability could result in a stack out-of-bounds write, potentially allowing an attacker to corrupt kernel memory. This may lead to privilege escalation, denial of service, or other system compromises. The CVSS score of 8.8 indicates a high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported at this time.

A patch is available and has been released by Ubuntu in their security notices USN-8567-1 and USN-8574-1. Users should update their Linux kernel packages to the fixed versions and reboot their systems to apply the changes. Due to an ABI change in the kernel update, recompilation and reinstallation of third-party kernel modules may be required. Follow vendor instructions carefully to ensure complete remediation.