« Volver al listado

CVE-2026-68197

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper

mwifiex_tdls_add_ht_oper() gates its follow-the-AP-bandwidth path on bss_desc->bcn_ht_cap being present, but then dereferences a different pointer, bss_desc->bcn_ht_oper:

if (ISSUPP_CHANWIDTH40(priv->adapter->hw_dot_11n_dev_cap) && bss_desc->bcn_ht_cap && ISALLOWED_CHANWIDTH40(bss_desc->bcn_ht_oper->ht_param))

bcn_ht_cap and bcn_ht_oper are populated independently while parsing the associated AP's beacon in mwifiex_update_bss_desc_with_ie(): an AP that advertises an HT Capabilities element but no HT Operation element leaves bcn_ht_cap non-NULL and bcn_ht_oper NULL.

Leer descripción completaMostrar menos

Setting up a TDLS link to a peer while associated to such an AP then dereferences the NULL bcn_ht_oper and crashes the kernel. Every other bcn_ht_oper user in the driver NULL-checks it first.

Guard on the pointer that is actually dereferenced.

Found by 0sec automated security-research tooling (https://0sec.ai).

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-68197",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "396939f94084d5923d558e9f22db48bc51156e47",
              "lessThan": "e1770f7410b4232a0267924f99751dc9c5ca31af",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "396939f94084d5923d558e9f22db48bc51156e47",
              "lessThan": "8c2058717fd06f05d421c2d3adf1dff3c3abcda1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "396939f94084d5923d558e9f22db48bc51156e47",
              "lessThan": "fba7eb7b248ea0618235f504158b685d752a153a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "396939f94084d5923d558e9f22db48bc51156e47",
              "lessThan": "eb42c3c8fd479166c42984728754cd779c71fd60",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "396939f94084d5923d558e9f22db48bc51156e47",
              "lessThan": "45011e4d9ba3f2182e5df64be65888044fa20771",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "396939f94084d5923d558e9f22db48bc51156e47",
              "lessThan": "9375a4ea4121625ef27a46b74781cda66a5cc61b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "396939f94084d5923d558e9f22db48bc51156e47",
              "lessThan": "cca4398aa305c22016d1714f388e2fa6ea4e5ad4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "396939f94084d5923d558e9f22db48bc51156e47",
              "lessThan": "c3d68e294cbb6a4090bb219d3dcaca85a011809b",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/net/wireless/marvell/mwifiex/tdls.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.16"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "3.16",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/net/wireless/marvell/mwifiex/tdls.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-10T13:20:07.150",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/45011e4d9ba3f2182e5df64be65888044fa20771",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8c2058717fd06f05d421c2d3adf1dff3c3abcda1",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9375a4ea4121625ef27a46b74781cda66a5cc61b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c3d68e294cbb6a4090bb219d3dcaca85a011809b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/cca4398aa305c22016d1714f388e2fa6ea4e5ad4",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e1770f7410b4232a0267924f99751dc9c5ca31af",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/eb42c3c8fd479166c42984728754cd779c71fd60",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/fba7eb7b248ea0618235f504158b685d752a153a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper\n\nmwifiex_tdls_add_ht_oper() gates its follow-the-AP-bandwidth path on\nbss_desc->bcn_ht_cap being present, but then dereferences a different\npointer, bss_desc->bcn_ht_oper:\n\n\tif (ISSUPP_CHANWIDTH40(priv->adapter->hw_dot_11n_dev_cap) &&\n\t    bss_desc->bcn_ht_cap &&\n\t    ISALLOWED_CHANWIDTH40(bss_desc->bcn_ht_oper->ht_param))\n\nbcn_ht_cap and bcn_ht_oper are populated independently while parsing the\nassociated AP's beacon in mwifiex_update_bss_desc_with_ie(): an AP that\nadvertises an HT Capabilities element but no HT Operation element leaves\nbcn_ht_cap non-NULL and bcn_ht_oper NULL. Setting up a TDLS link to a\npeer while associated to such an AP then dereferences the NULL\nbcn_ht_oper and crashes the kernel. Every other bcn_ht_oper user in the\ndriver NULL-checks it first.\n\nGuard on the pointer that is actually dereferenced.\n\nFound by 0sec automated security-research tooling (https://0sec.ai)."
    }
  ],
  "lastModified": "2026-08-19T17:20:35.977",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}