CVE-2026-74488

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the mwifiex 11n dispatch amsdu pkt() function when parsing A-MSDU TDLS frames. The function uses ieee80211 amsdu to 8023s() to split an A-MSDU and iterates through the resulting subframes. For each subframe, it calls mwifiex process tdls action frame() but incorrectly passes skb->len (the length of the A-MSDU parent) instead of rx skb->len (the length of the actual subframe).

This leads to two primary issues: if the parent buffer has already been freed, a use-after-free occurs. If the parent is reused, the length is over-stated for any subframe shorter than the last one. Because the callee uses this length to determine the boundary for element walking, a too-large length allows the process to read and copy data beyond the subframe boundary. Exploitation requires TDLS support in firmware and the TDLS ethertype on the subframe.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.