CVE-2026-68326 - Vulnerability Details

- wifi: mwifiex: bound uAP association event IEs to the event buffer

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mwifiex: bound uAP association event IEs to the event buffer

mwifiex_process_uap_event() handles EVENT_UAP_STA_ASSOC by exposing the
(re)association request IEs that the firmware copies into the event:

sinfo->assoc_req_ies = &event->data[len];
len = (u8 *)sinfo->assoc_req_ies - (u8 *)&event->frame_control;
sinfo->assoc_req_ies_len = le16_to_cpu(event->len) - (u16)len;

event->len is supplied by the device firmware and is never validated,
and the subtraction is unchecked. assoc_req_ies points into
adapter->event_body[MAX_EVENT_SIZE], a fixed-size array embedded in the
kmalloc()'d struct mwifiex_adapter.

On the ap_11n_enabled path mwifiex_set_sta_ht_cap() walks these IEs with
cfg80211_find_ie(), whose for_each_element() loop dereferences each
element header. A firmware-reported event->len larger than the bytes
actually received makes assoc_req_ies_len describe IEs that extend past
event_body, so the walk reads out of the adapter slab object, a
slab-out-of-bounds read (KASAN: slab-out-of-bounds in cfg80211_find_ie).
An event->len smaller than the header instead makes the int subtraction
negative, which wraps to a huge size_t when stored in assoc_req_ies_len.
The same length is handed to cfg80211_new_sta(), so a more modest
over-claim can also copy stale event_body bytes into the
NL80211_CMD_NEW_STATION notification.

A malicious or malfunctioning mwifiex device (USB/SDIO/PCIe) can deliver
such an event while the interface is in AP/uAP mode.

Validate event->len before use: reject a length that underflows the
header or that would place the IEs outside the event_body[] buffer the
event was copied into. event->len here is struct mwifiex_assoc_event.len,
a payload field internal to this event, not the transport frame length,
so it is validated in this handler rather than at the generic
MWIFIEX_TYPE_EVENT receive path, which only sees the event cause and the
transport frame length. The bound is against event_body[MAX_EVENT_SIZE]
rather than the actually-received length because the transports store the
event differently (USB and SDIO leave the 4-byte event header in
event_skb, PCIe strips it via skb_pull), whereas event_body is the single
fixed buffer all of them copy the event into. This is the event-path
analogue of the receive-path bounds checks added in commit 119585281617
("wifi: mwifiex: Fix OOB and integer underflow when rx packets").

Published: 2026-08-10

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability resides in the Linux kernel mwifiex driver, where the handler for a U‑AP association event dereferences an unvalidated length field supplied by the device firmware. If the firmware reports a length larger or smaller than the actual payload, the driver calculates an incorrect IEs length, causing an out‑of‑bounds read of the event buffer or an integer underflow that feeds a massive value into downstream functions. This read can reveal kernel memory contents and, depending on the surrounding code, may trigger a kernel crash or other instability. The impact is therefore a local denial of service and potential information disclosure. The weakness corresponds to unchecked input bounds and integer underflow.

Affected Systems

All Linux kernel installations that include the mwifiex driver, regardless of the kernel version. Any kernel compiling the mwifiex module is potentially impacted.

Risk and Exploitability

The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 8.8 indicates high severity, but the nature of the bug—an out‑of‑bounds read that could lead to a crash—means it still represents a significant risk when the mwifiex driver is active. The likely attack vector is local or physical: an attacker must provide crafted firmware events to the mwifex device while it is operating in AP/uAP mode. Such an event can be injected by a compromised or malicious device or by an attacker who gains physical access to the hardware.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`e568634ae7ac379661c90731d480e067929420a1`	affected	< a616616b938f7922a93e79bef16b4643c57c0922
`e568634ae7ac379661c90731d480e067929420a1`	affected	< 1ae00b6d9a6c82eb3de151d9b04ed59e06cc100f
`e568634ae7ac379661c90731d480e067929420a1`	affected	< e7e93d3e8c240bdb70c41e79d169d74dfb442843
`e568634ae7ac379661c90731d480e067929420a1`	affected	< a3f47d7c75ddad1a14621a309286f9fae3cba191
`e568634ae7ac379661c90731d480e067929420a1`	affected	< ad26c75ae25749313248f06510ebe43b5bf4adcc
`e568634ae7ac379661c90731d480e067929420a1`	affected	< d21464d93f8ba464dc3d7b4b31c6e0adcd9f659c
`e568634ae7ac379661c90731d480e067929420a1`	affected	< b6766d7ea43edf5de9d5a572bc58b631d09efe4b
`e568634ae7ac379661c90731d480e067929420a1`	affected	< f0858bfc7d3cab411a447b88e3ef970e575032c9

Linux

affected

Version	Status	Constraints
`3.5`	affected	—
`0`	unaffected	< 3.5
`5.10.265`	unaffected	≤ 5.10.*
`5.15.216`	unaffected	≤ 5.15.*
`6.1.183`	unaffected	≤ 6.1.*
`6.6.148`	unaffected	≤ 6.6.*
`6.12.101`	unaffected	≤ 6.12.*
`6.18.42`	unaffected	≤ 6.18.*
`7.1.6`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[e568634ae7ac379661c90731d480e067929420a1,a3f47d7c75ddad1a14621a309286f9fae3cba191)`	affected	code_commit	—
`[e568634ae7ac379661c90731d480e067929420a1,ad26c75ae25749313248f06510ebe43b5bf4adcc)`	affected	code_commit	—
`[e568634ae7ac379661c90731d480e067929420a1,d21464d93f8ba464dc3d7b4b31c6e0adcd9f659c)`	affected	code_commit	—
`[e568634ae7ac379661c90731d480e067929420a1,b6766d7ea43edf5de9d5a572bc58b631d09efe4b)`	affected	code_commit	—
`[e568634ae7ac379661c90731d480e067929420a1,f0858bfc7d3cab411a447b88e3ef970e575032c9)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.5`	affected	generic	—
`[0,3.5)`	unaffected	generic	—
`[6.6.148,6.7.0)`	unaffected	semver	—
`[6.12.101,6.13.0)`	unaffected	semver	—
`[6.18.42,6.19.0)`	unaffected	semver	—
`[7.1.6,7.2.0)`	unaffected	semver	—
`[7.2-rc5,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the kernel patch that adds bounds checks to mwifex_process_uap_event and related functions.
Disable the mwifiex driver on affected nodes (e.g., add “blacklist mwifex” to /etc/modprobe.d/) until the kernel update is deployed.
If disabling the driver is not feasible, prohibit the device from entering AP/uAP mode by configuring the firmware or network service to disallow AP mode, or by physically removing the wireless interface.

Generated by OpenCVE AI on August 14, 2026 at 00:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4745-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00266.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1ae00b6d9a6c82eb3de151d9b04ed59e06cc100f
https://git.kernel.org/stable/c/a3f47d7c75ddad1a14621a309286f9fae3cba191
https://git.kernel.org/stable/c/a616616b938f7922a93e79bef16b4643c57c0922
https://git.kernel.org/stable/c/ad26c75ae25749313248f06510ebe43b5bf4adcc
https://git.kernel.org/stable/c/b6766d7ea43edf5de9d5a572bc58b631d09efe4b
https://git.kernel.org/stable/c/d21464d93f8ba464dc3d7b4b31c6e0adcd9f659c
https://git.kernel.org/stable/c/e7e93d3e8c240bdb70c41e79d169d74dfb442843
https://git.kernel.org/stable/c/f0858bfc7d3cab411a447b88e3ef970e575032c9
https://lore.kernel.org/linux-cve-announce/2026081034-CVE-2026-68326-5d46@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-68326
https://www.cve.org/CVERecord?id=CVE-2026-68326

History

Wed, 19 Aug 2026 16:45:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/1ae00b6d9a6c82eb3de151d9b04ed59e06cc100f https://git.kernel.org/stable/c/a616616b938f7922a93e79bef16b4643c57c0922 https://git.kernel.org/stable/c/e7e93d3e8c240bdb70c41e79d169d74dfb442843

Thu, 13 Aug 2026 23:15:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Thu, 13 Aug 2026 04:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-119 CWE-190 CWE-20

Wed, 12 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://lore.kernel.org/linux-cve-announce/2026081034-CVE-2026-68326-5d46@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-68326 https://www.cve.org/CVERecord?id=CVE-2026-68326
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Mon, 10 Aug 2026 17:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-119 CWE-190 CWE-20

Mon, 10 Aug 2026 12:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: bound uAP association event IEs to the event buffer mwifiex_process_uap_event() handles EVENT_UAP_STA_ASSOC by exposing the (re)association request IEs that the firmware copies into the event: sinfo->assoc_req_ies = &event->data[len]; len = (u8 )sinfo->assoc_req_ies - (u8 )&event->frame_control; sinfo->assoc_req_ies_len = le16_to_cpu(event->len) - (u16)len; event->len is supplied by the device firmware and is never validated, and the subtraction is unchecked. assoc_req_ies points into adapter->event_body[MAX_EVENT_SIZE], a fixed-size array embedded in the kmalloc()'d struct mwifiex_adapter. On the ap_11n_enabled path mwifiex_set_sta_ht_cap() walks these IEs with cfg80211_find_ie(), whose for_each_element() loop dereferences each element header. A firmware-reported event->len larger than the bytes actually received makes assoc_req_ies_len describe IEs that extend past event_body, so the walk reads out of the adapter slab object, a slab-out-of-bounds read (KASAN: slab-out-of-bounds in cfg80211_find_ie). An event->len smaller than the header instead makes the int subtraction negative, which wraps to a huge size_t when stored in assoc_req_ies_len. The same length is handed to cfg80211_new_sta(), so a more modest over-claim can also copy stale event_body bytes into the NL80211_CMD_NEW_STATION notification. A malicious or malfunctioning mwifiex device (USB/SDIO/PCIe) can deliver such an event while the interface is in AP/uAP mode. Validate event->len before use: reject a length that underflows the header or that would place the IEs outside the event_body[] buffer the event was copied into. event->len here is struct mwifiex_assoc_event.len, a payload field internal to this event, not the transport frame length, so it is validated in this handler rather than at the generic MWIFIEX_TYPE_EVENT receive path, which only sees the event cause and the transport frame length. The bound is against event_body[MAX_EVENT_SIZE] rather than the actually-received length because the transports store the event differently (USB and SDIO leave the 4-byte event header in event_skb, PCIe strips it via skb_pull), whereas event_body is the single fixed buffer all of them copy the event into. This is the event-path analogue of the receive-path bounds checks added in commit 119585281617 ("wifi: mwifiex: Fix OOB and integer underflow when rx packets").
Title		wifi: mwifiex: bound uAP association event IEs to the event buffer
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/a3f47d7c75ddad1a14621a309286f9fae3cba191 https://git.kernel.org/stable/c/ad26c75ae25749313248f06510ebe43b5bf4adcc https://git.kernel.org/stable/c/b6766d7ea43edf5de9d5a572bc58b631d09efe4b https://git.kernel.org/stable/c/d21464d93f8ba464dc3d7b4b31c6e0adcd9f659c https://git.kernel.org/stable/c/f0858bfc7d3cab411a447b88e3ef970e575032c9

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-10T12:03:02.372Z

Updated: 2026-08-19T16:33:21.015Z

Reserved: 2026-07-30T09:28:09.382Z

Link: CVE-2026-68326

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-10T13:20:22.783

Modified: 2026-08-19T17:20:42.817

Link: CVE-2026-68326

Redhat

Severity : Moderate

Publid Date: 2026-08-10T00:00:00Z

Links: CVE-2026-68326 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-14T00:45:17Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object