SB20260812337 - NULL pointer dereference in Linux kernel marvell mwifiex driver

Description

This security bulletin contains information about 1 vulnerability.

1) NULL pointer dereference (CVE-ID: CVE-2026-68197)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in mwifiex_tdls_add_ht_oper() when setting up a TDLS link to a peer while associated with an access point that advertises HT Capabilities but omits the HT Operation element. A local user can trigger the vulnerable code path to cause a denial of service.

The issue occurs because the driver checks bcn_ht_cap but dereferences bcn_ht_oper, which may remain NULL after beacon parsing.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/45011e4d9ba3f2182e5df64be65888044fa20771
• https://git.kernel.org/stable/c/9375a4ea4121625ef27a46b74781cda66a5cc61b
• https://git.kernel.org/stable/c/c3d68e294cbb6a4090bb219d3dcaca85a011809b
• https://git.kernel.org/stable/c/cca4398aa305c22016d1714f388e2fa6ea4e5ad4
• https://git.kernel.org/stable/c/eb42c3c8fd479166c42984728754cd779c71fd60