CVE-2026-74488

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames

mwifiex_11n_dispatch_amsdu_pkt() splits an A-MSDU with

ieee80211_amsdu_to_8023s() and walks the resulting subframes. For each

subframe it passes the subframe data pointer to

mwifiex_process_tdls_action_frame(), but pairs it with skb->len, the

length of the A-MSDU parent, instead of rx_skb->len:

rx_skb = __skb_dequeue(&list);

rx_hdr = (struct rx_packet_hdr *)rx_skb->data;

if (ISSUPP_TDLS_ENABLED(priv->adapter->fw_cap_info) &&

ntohs(rx_hdr->eth803_hdr.h_proto) == ETH_P_TDLS) {

mwifiex_process_tdls_action_frame(priv, (u8 *)rx_hdr,

skb->len);

}

The parent is not a valid description of that buffer, and may not be

valid memory at all. ieee80211_amsdu_to_8023s() ends with

if (!reuse_skb)

dev_kfree_skb(skb);

and it only sets reuse_skb when the parent is linear, is not a

head_frag, and is being consumed as the *last* subframe. So

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References