Cloudanix VulnDB

CVE-2026-68197

None

CVSS

—

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux wireless driver can cause computers to crash when connecting to certain Wi-Fi networks that use a specific setup for faster connections.

Exploitation
Adjacent Network
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Low
Patch risk
None

What it actually does

NULL pointer dereference in mwifiex_tdls_add_ht_oper when an AP advertises HT Capabilities without an HT Operation element, causing bss_desc->bcn_ht_oper to be NULL while bss_desc->bcn_ht_cap is non-NULL, resulting in kernel crash on TDLS link setup.

Why it matters to the business

Wireless clients using the mwifiex driver can experience sudden kernel panics and system reboots when associating to certain access points and attempting TDLS connections, leading to loss of network connectivity and potential data loss or service interruption on affected Linux systems.

How an attack unfolds

An attacker positions a wireless access point that broadcasts an HT Capabilities element but omits the HT Operation element. A victim system running the vulnerable mwifiex driver associates to this AP. When the system later attempts to establish a TDLS link, mwifiex_tdls_add_ht_oper dereferences the NULL bcn_ht_oper pointer and triggers a kernel panic.

How to fix it

Apply the upstream kernel patch that adds a NULL check on bss_desc->bcn_ht_oper before dereference in mwifiex_tdls_add_ht_oper. Rebuild and deploy the fixed kernel or update to a distribution release containing the fix.

How to confirm the fix worked

Confirm the patch is present by inspecting mwifiex_update_bss_desc_with_ie and mwifiex_tdls_add_ht_oper for the added NULL guard on bcn_ht_oper. Test by associating to an AP emitting HT Capabilities without HT Operation and attempting TDLS; the system should no longer panic.

Typical attack path

  1. Deploy or compromise an AP that sends HT Capabilities but no HT Operation element in beacons
  2. Victim associates to the AP using mwifiex driver
  3. Victim initiates TDLS setup with a peer
  4. mwifiex_tdls_add_ht_oper executes the unguarded dereference and crashes the kernel

How to detect it

Search kernel logs and dmesg for mwifiex NULL pointer dereference oops or panic messages occurring shortly after association or TDLS activity. Correlate with beacon parsing from APs lacking HT Operation elements.

  • mwifiex_tdls_add_ht_oper
  • bcn_ht_oper
  • NULL pointer dereference.*mwifiex

What your security team should do

  • Prioritize patching Linux kernels containing the mwifiex driver on all wireless client systems
  • Monitor kernel logs for mwifiex-related NULL pointer dereference oops until patches are deployed
  • Consider disabling TDLS on affected systems as a temporary mitigation if patching is delayed

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper mwifiex_tdls_add_ht_oper() gates its follow-the-AP-bandwidth path on bss_desc->bcn_ht_cap being present, but then dereferences a different pointer, bss_desc->bcn_ht_oper: if (ISSUPP_CHANWIDTH40(priv->adapter->hw_dot_11n_dev_cap) && bss_desc->bcn_ht_cap && ISALLOWED_CHANWIDTH40(bss_desc->bcn_ht_oper->ht_param)) bcn_ht_cap and bcn_ht_oper are populated independently while parsing the associated AP's beacon in mwifiex_update_bss_desc_with_ie(): an AP that advertises an HT Capabilities element but no HT Operation element leaves bcn_ht_cap non-NULL and bcn_ht_oper NULL. Setting up a TDLS link to a peer while associated to such an AP then dereferences the NULL bcn_ht_oper and crashes the kernel. Every other bcn_ht_oper user in the driver NULL-checks it first. Guard on the pointer that is actually dereferenced. Found by 0sec automated security-research tooling (https://0sec.ai).

Affected packages

Ecosystem Package Introduced Fixed