{
  "cveId": "CVE-2026-74336",
  "url": "https://patchblox.com/security/cve/CVE-2026-74336",
  "summary": "CVE-2026-74336 is fixed in linux on 1 platform by DEBIAN-CVE-2026-74336 (version 7.1.5-1), released August 15, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  wifi: mac80211: bound S1G TIM PVB walk to the TI...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  wifi: mac80211: bound S1G TIM PVB walk to the TIM element  ieee80211_s1g_check_tim() parses the S1G Partial Virtual Bitmap (PVB) of a received TIM element. The TIM is handed in as the element payload: ieee802_11_parse_elems_full() stores elems-\u003Etim = elem-\u003Edata and elems-\u003Etim_len = elem-\u003Edatalen (net/mac80211/parse.c), so the valid bytes are [tim, tim \u002B tim_len).  When walking the encoded blocks the function passes the walker an end sentinel of (const u8 *)tim \u002B tim_len \u002B 2, i.e. two bytes past the end of the element. ieee80211_s1g_find_target_block() loops while (ptr \u002B 1 \u003C= end) and dereferences ptr (and the per-mode ieee80211_s1g_len_*() helpers read *ptr), so it can read up to two bytes beyond the TIM element -- an out-of-bounds read of adjacent skb/heap data when the TIM is the last element in the frame. The \u002B2 appears to account for the element id/len header, but tim already points past that header at the element payload, so the addend is wrong.  Pass the correct element end, (const u8 *)tim \u002B tim_len.",
  "published": "2026-08-15T06:22:34Z",
  "severity": "",
  "epss": 0.00206,
  "epssPercentile": 0.10766,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.1.5-1",
      "fix": "DEBIAN-CVE-2026-74336",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-74336",
      "released": "2026-08-15T22:38:55Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}