CVE-2026-78807

wpa_supplicant versions prior to 2.12 fail to validate that a PMKSA (pairwise master key security association) cache entry selected via the driver-based PMKSA path in wpa.c matches the current network context and AKMP (authentication and key management protocol), an origin-validation error (CWE-346). A local attacker with low privileges can trigger use of a cached PMKSA entry belonging to a different network context, bypassing the intended network-context and AKMP matching. This can cause the supplicant to authenticate using a pairwise master key that was not established for the target network, producing high confidentiality and integrity impact per the CVSS 7.1 score. Because wpa_supplicant is the standard WPA/WPA2/WPA3 client shipped with Linux distributions, Android, and a vast range of embedded devices, the affected installed base is enormous, although exploitation requires local access to the device. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is currently known.

What to do: Upgrade to wpa_supplicant 2.12 or a vendor/distro-backported patched package when available, since most users receive fixes downstream rather than from upstream. Until patched, limit untrusted local shell access on Wi-Fi-capable hosts and check whether your drivers/firmware use driver-based (offloaded) PMKSA caching, disabling that mode if feasible. Monitor distribution security announcements for the 2.12 fix or backports.