CVE-2026-68197

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper

mwifiex_tdls_add_ht_oper() gates its follow-the-AP-bandwidth path on

bss_desc->bcn_ht_cap being present, but then dereferences a different

pointer, bss_desc->bcn_ht_oper:

if (ISSUPP_CHANWIDTH40(priv->adapter->hw_dot_11n_dev_cap) &&

bss_desc->bcn_ht_cap &&

ISALLOWED_CHANWIDTH40(bss_desc->bcn_ht_oper->ht_param))

bcn_ht_cap and bcn_ht_oper are populated independently while parsing the

associated AP's beacon in mwifiex_update_bss_desc_with_ie(): an AP that

advertises an HT Capabilities element but no HT Operation element leaves

bcn_ht_cap non-NULL and bcn_ht_oper NULL. Setting up a TDLS link to a

peer while associated to such an AP then dereferences the NULL

bcn_ht_oper and crashes the kernel. Every other bcn_ht_oper user in the

driver NULL-checks it first.

Guard on the pointer that is actually dereferenced.

Found by 0sec automated s

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References