SB20260812208 - Out-of-bounds read in Linux kernel marvell mwifiex driver

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds read (CVE-ID: CVE-2026-68326)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 2.4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local attacker to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in mwifiex_process_uap_event() and the assoc_req_ies parsing path when processing a firmware-reported uAP association event with a crafted event length. A local attacker can supply a malicious or malformed event from a mwifiex device to disclose sensitive information.

The issue can be triggered by a malicious or malfunctioning mwifiex USB, SDIO, or PCIe device while the interface is operating in AP/uAP mode. An underflow in the calculated length may also cause stale event buffer bytes to be exposed through an NL80211_CMD_NEW_STATION notification.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/a3f47d7c75ddad1a14621a309286f9fae3cba191
• https://git.kernel.org/stable/c/ad26c75ae25749313248f06510ebe43b5bf4adcc
• https://git.kernel.org/stable/c/b6766d7ea43edf5de9d5a572bc58b631d09efe4b
• https://git.kernel.org/stable/c/d21464d93f8ba464dc3d7b4b31c6e0adcd9f659c
• https://git.kernel.org/stable/c/f0858bfc7d3cab411a447b88e3ef970e575032c9