CVE-2026-78807

Name	CVE-2026-78807
Description	An issue in wpa_supplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP matching for PMKSA caching via missing validation in the driver based PMKSA selection path in wpa.c
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
wpa (PTS)	bookworm	2:2.10-12+deb12u3	vulnerable
	bookworm (security)	2:2.10-12+deb12u2	vulnerable
	trixie	2:2.10-24	vulnerable
	forky, sid	2:2.10-25	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
wpa	source	(unstable)	(unfixed)

Notes

https://w1.fi/security/2026-2/missing-network-context-validation-for-pmksa-caching.txt
Fixed by: https://git.w1.fi/cgit/hostap/commit/?id=de5e73a03c34d83568afb3183b2b28c8d7641a30