CVE-2026-98184: wifi: mwifiex: prevent authentication frame length truncation
In the Linux kernel, the following vulnerability has been resolved:
wifi: mwifiex: prevent authentication frame length truncation
mwifiexcfg80211authenticate() derives the authentication frame length from req->ielen and req->authdatalen, both of type sizet, but stores it in a u16.
NL80211ATTRAUTHDATA only has a minimum length policy. Since nlalen is a u16, a single attribute can carry up to 65531 bytes of payload, so the sum can exceed U16MAX before it is assigned to pktlen. The truncated pktlen determines the skb frame area, while the copy length remains req->authdatalen - 4, resulting in a heap buffer overflow.
For example, with authdatalen equal to 65510 and no IEs, the sum is 65546. It is truncated to 10 and then reduced by four to 6. The driver appends only six bytes to the skb with skbput(), but then copies 65506 user-provided bytes into the authentication body.
Reaching this path requires CAPNETADMIN in the user namespace owning the network namespace, an up station netdev, and a suitable BSS/SAE authentication request.
Compute the length in sizet, reject values that cannot be represented by the firmware's u16 frame length field, and only then assign it to pktlen.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In mwifiex_cfg80211_authenticate(), compute the authentication frame length in size_t, reject values that cannot be represented by the firmware's u16 frame length field (U16_MAX), and only then assign the validated length to pkt_len.
Event History
Frequently Asked Questions
Who can realistically exploit this issue?
Exploitation requires CAP_NET_ADMIN in the user namespace that owns the affected network namespace. The attacker also needs an active station-mode network interface and must issue a suitable BSS/SAE authentication request.
Can an oversized authentication payload trigger memory corruption?
Yes. Authentication data and IE lengths can exceed the u16 frame-length limit; the allocated skb area is based on the truncated value while copying still uses the larger user-provided authentication-data length, causing a heap buffer overflow.
What does the fix do?
The fix calculates the frame length using size_t and rejects lengths that cannot be represented by the firmware u16 frame-length field before assigning the value.