CVE-2026-98184 (GCVE-0-2026-98184)
Vulnerability from cvelistv5
Published
2026-10-06 08:44
Modified
2026-10-19 09:15
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: prevent authentication frame length truncation mwifiex_cfg80211_authenticate() derives the authentication frame length from req->ie_len and req->auth_data_len, both of type size_t, but stores it in a u16. NL80211_ATTR_AUTH_DATA only has a minimum length policy. Since nla_len is a u16, a single attribute can carry up to 65531 bytes of payload, so the sum can exceed U16_MAX before it is assigned to pkt_len. The truncated pkt_len determines the skb frame area, while the copy length remains req->auth_data_len - 4, resulting in a heap buffer overflow. For example, with auth_data_len equal to 65510 and no IEs, the sum is 65546. It is truncated to 10 and then reduced by four to 6. The driver appends only six bytes to the skb with skb_put(), but then copies 65506 user-provided bytes into the authentication body. Reaching this path requires CAP_NET_ADMIN in the user namespace owning the network namespace, an up station netdev, and a suitable BSS/SAE authentication request. Compute the length in size_t, reject values that cannot be represented by the firmware's u16 frame length field, and only then assign it to pkt_len.
References
Impacted products
Vendor Product Version
Linux Linux Version: 36995892c271cce5e2230bc165a06f109b117222
Version: 36995892c271cce5e2230bc165a06f109b117222
Version: 36995892c271cce5e2230bc165a06f109b117222
Version: 36995892c271cce5e2230bc165a06f109b117222
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/marvell/mwifiex/cfg80211.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "25c45a2075cc00faed45f92a64bb172fb074a2ee",
              "status": "affected",
              "version": "36995892c271cce5e2230bc165a06f109b117222",
              "versionType": "git"
            },
            {
              "lessThan": "5747eaa38a7fcad48be2fd910b65008198b2b06c",
              "status": "affected",
              "version": "36995892c271cce5e2230bc165a06f109b117222",
              "versionType": "git"
            },
            {
              "lessThan": "877b61a67d5eb3e616478daf3908114b57feff1e",
              "status": "affected",
              "version": "36995892c271cce5e2230bc165a06f109b117222",
              "versionType": "git"
            },
            {
              "lessThan": "fa00193eb991f92b007aefe7afb6a7566976dacf",
              "status": "affected",
              "version": "36995892c271cce5e2230bc165a06f109b117222",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/marvell/mwifiex/cfg80211.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.54",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.8",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: prevent authentication frame length truncation\n\nmwifiex_cfg80211_authenticate() derives the authentication frame length\nfrom req-\u003eie_len and req-\u003eauth_data_len, both of type size_t, but stores\nit in a u16.\n\nNL80211_ATTR_AUTH_DATA only has a minimum length policy. Since nla_len is\na u16, a single attribute can carry up to 65531 bytes of payload, so the\nsum can exceed U16_MAX before it is assigned to pkt_len. The truncated\npkt_len determines the skb frame area, while the copy length remains\nreq-\u003eauth_data_len - 4, resulting in a heap buffer overflow.\n\nFor example, with auth_data_len equal to 65510 and no IEs, the sum is\n65546. It is truncated to 10 and then reduced by four to 6. The driver\nappends only six bytes to the skb with skb_put(), but then copies 65506\nuser-provided bytes into the authentication body.\n\nReaching this path requires CAP_NET_ADMIN in the user namespace owning\nthe network namespace, an up station netdev, and a suitable BSS/SAE\nauthentication request.\n\nCompute the length in size_t, reject values that cannot be represented by\nthe firmware\u0027s u16 frame length field, and only then assign it to pkt_len."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:15:15.381Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/25c45a2075cc00faed45f92a64bb172fb074a2ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/5747eaa38a7fcad48be2fd910b65008198b2b06c"
        },
        {
          "url": "https://git.kernel.org/stable/c/877b61a67d5eb3e616478daf3908114b57feff1e"
        },
        {
          "url": "https://git.kernel.org/stable/c/fa00193eb991f92b007aefe7afb6a7566976dacf"
        }
      ],
      "title": "wifi: mwifiex: prevent authentication frame length truncation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98184",
    "datePublished": "2026-10-06T08:44:26.836Z",
    "dateReserved": "2026-09-25T10:25:14.323Z",
    "dateUpdated": "2026-10-19T09:15:15.381Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.