CVE-2026-68326

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mwifiex: bound uAP association event IEs to the event buffer

mwifiex_process_uap_event() handles EVENT_UAP_STA_ASSOC by exposing the

(re)association request IEs that the firmware copies into the event:

sinfo->assoc_req_ies = &event->data[len];

len = (u8 *)sinfo->assoc_req_ies - (u8 *)&event->frame_control;

sinfo->assoc_req_ies_len = le16_to_cpu(event->len) - (u16)len;

event->len is supplied by the device firmware and is never validated,

and the subtraction is unchecked. assoc_req_ies points into

adapter->event_body[MAX_EVENT_SIZE], a fixed-size array embedded in the

kmalloc()'d struct mwifiex_adapter.

On the ap_11n_enabled path mwifiex_set_sta_ht_cap() walks these IEs with

cfg80211_find_ie(), whose for_each_element() loop dereferences each

element header. A firmware-reported event->len larger than the bytes

actually received makes assoc_req_ies_len describe IEs that extend past

event_body, so the walk r

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References