Cloudanix VulnDB

CVE-2026-98184

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in certain Linux WiFi drivers can let a highly privileged local user send specially crafted network requests that corrupt memory and potentially crash the system or gain more control.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Buffer Overflow
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Heap buffer overflow caused by assigning a size_t-derived authentication frame length to a u16 variable, allowing skb_put to allocate a small buffer while a subsequent copy writes up to 65506 attacker-controlled bytes from NL80211_ATTR_AUTH_DATA.

Why it matters to the business

Systems using the mwifiex WiFi driver face risk of local memory corruption that could lead to crashes or privilege escalation when an attacker already possesses CAP_NET_ADMIN in a user namespace; low external exploit likelihood limits broad operational impact.

How an attack unfolds

An attacker with CAP_NET_ADMIN in the owning user namespace brings an interface up, then issues a cfg80211 authentication request containing an NL80211_ATTR_AUTH_DATA attribute whose length plus optional IEs exceeds 65535 bytes; the driver truncates the total to a u16 value, allocates a correspondingly small skb, and copies the full user length minus four bytes, overflowing the heap buffer.

How to fix it

Apply the upstream kernel patch that computes the frame length in size_t, rejects any value exceeding the firmware's u16 limit, and only then stores the result in pkt_len; rebuild and deploy the fixed kernel on affected systems.

How to confirm the fix worked

Confirm the patch is present by inspecting the mwifiex_cfg80211_authenticate function for size_t length calculation and an explicit rejection of values larger than the u16 maximum before assignment to pkt_len; test with a deliberately oversized auth_data_len to verify the request is now rejected.

Typical attack path

  1. Obtain CAP_NET_ADMIN in a user namespace controlling the network namespace
  2. Create or select an mwifiex station interface and bring it up
  3. Craft and send an NL80211_CMD_AUTHENTICATE netlink message with a large NL80211_ATTR_AUTH_DATA payload
  4. Trigger skb allocation with the truncated length and perform the oversized copy into the authentication frame body

How to detect it

Review netlink audit logs and nl80211 traces for authentication requests carrying NL80211_ATTR_AUTH_DATA attributes whose reported length exceeds 65535 bytes; correlate with mwifiex driver oops or slab allocation warnings indicating oversized copies.

What your security team should do

  • Prioritize kernel upgrade on any host exposing the mwifiex driver
  • Restrict CAP_NET_ADMIN to trusted processes only
  • Monitor for unusual netlink authentication requests from user namespaces

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: prevent authentication frame length truncation mwifiex_cfg80211_authenticate() derives the authentication frame length from req->ie_len and req->auth_data_len, both of type size_t, but stores it in a u16. NL80211_ATTR_AUTH_DATA only has a minimum length policy. Since nla_len is a u16, a single attribute can carry up to 65531 bytes of payload, so the sum can exceed U16_MAX before it is assigned to pkt_len. The truncated pkt_len determines the skb frame area, while the copy length remains req->auth_data_len - 4, resulting in a heap buffer overflow. For example, with auth_data_len equal to 65510 and no IEs, the sum is 65546. It is truncated to 10 and then reduced by four to 6. The driver appends only six bytes to the skb with skb_put(), but then copies 65506 user-provided bytes into the authentication body. Reaching this path requires CAP_NET_ADMIN in the user namespace owning the network namespace, an up station netdev, and a suitable BSS/SAE authentication request. Compute the length in size_t, reject values that cannot be represented by the firmware's u16 frame length field, and only then assign it to pkt_len.

Affected packages

Ecosystem Package Introduced Fixed