CVE-2026-68197: wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper
In the Linux kernel, the following vulnerability has been resolved:
wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper
mwifiextdlsaddhtoper() gates its follow-the-AP-bandwidth path on bssdesc->bcnhtcap being present, but then dereferences a different pointer, bssdesc->bcnhtoper:
if (ISSUPPCHANWIDTH40(priv->adapter->hwdot11ndevcap) && bssdesc->bcnhtcap && ISALLOWEDCHANWIDTH40(bssdesc->bcnhtoper->htparam))
bcnhtcap and bcnhtoper are populated independently while parsing the associated AP's beacon in mwifiexupdatebssdescwithie(): an AP that advertises an HT Capabilities element but no HT Operation element leaves bcnhtcap non-NULL and bcnhtoper NULL. Setting up a TDLS link to a peer while associated to such an AP then dereferences the NULL bcnhtoper and crashes the kernel. Every other bcnhtoper user in the driver NULL-checks it first.
Guard on the pointer that is actually dereferenced.
Found by 0sec automated security-research tooling (https://0sec.ai).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68197?
The severity of CVE-2026-68197 is rated at 48.
What does CVE-2026-68197 involve?
CVE-2026-68197 involves a NULL dereference vulnerability in the mwifiex driver when the access point has HT capability but lacks HT operational parameters.
How do I fix CVE-2026-68197?
To fix CVE-2026-68197, update your Linux kernel to the latest stable version where the vulnerability has been resolved.
Which Linux kernel versions are affected by CVE-2026-68197?
CVE-2026-68197 affects versions of the Linux kernel that include the mwifiex driver with the specific bug.
Can CVE-2026-68197 be exploited remotely?
CVE-2026-68197 may allow local attackers to cause a denial of service, but remote exploitation is not applicable as it pertains to local wireless connectivity.