CVE-2026-68326

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the mwifiex process uap event() function when handling EVENT UAP STA ASSOC events. The function uses event->len, a value supplied by the device firmware, without proper validation. This lack of validation can lead to an integer underflow during subtraction or a slab-out-of-bounds read when mwifiex set sta ht cap() processes Information Elements (IEs) using cfg80211 find ie(). Specifically, if event->len is larger than the bytes received, the system reads beyond the event body buffer in the mwifiex adapter slab object. If event->len is smaller than the header, the resulting negative value wraps to a large size t, potentially causing stale data from event body to be copied into the NL80211 CMD NEW STATION notification via cfg80211 new sta(). A malicious or malfunctioning mwifiex device connected via USB, SDIO, or PCIe can trigger this behavior while the interface is in AP/uAP mode.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.