HIGH Introduced in 3.0
mwifiex ScanResponse OOB
CVE-2026-98185
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: validate scan response extents mwifiex_ret_802_11_scan() subtracts the fixed response fields and the firmware-provided BSS length from resp->size without first proving that either extent fits. A short response or oversized BSS length can therefore underflow tlv_buf_size and make the TLV parser walk beyond the command response. Compute the fixed extent from the selected normal or background scan response. Validate that the fixed fields and BSS data fit before deriving the TLV extent and entering the parser.
02KernelScan AI Analysis
Risk summary
Devices with Marvell mwifiex WiFi chipsets are vulnerable to out-of-bounds memory access when processing scan responses. A malicious access point within WiFi range can send crafted frames that cause the firmware to produce a malformed scan response, leading to kernel memory corruption or crash. No user interaction or privileges on the target device are required.
Vulnerability analysis
The mwifiex WiFi driver computes the size of the TLV buffer in a firmware scan response by subtracting the fixed response header and the firmware-reported BSS description length from the total response size. When the firmware supplies a short response or an oversized BSS length, this unsigned subtraction underflows, producing a very large TLV buffer extent that causes the TLV parser to walk far beyond the actual command response buffer. The fix computes the fixed-field extent from the actual response structure, validates that both the fixed fields and BSS data fit within the response before deriving the TLV extent, and rejects responses that fail these checks. This vulnerability is reachable over WiFi: a malicious access point within radio range can send crafted beacon or probe response frames that cause the firmware to generate a malformed scan response, which the driver then processes during a routine WiFi scan. No privileges or user interaction on the target device are required—only that the device has a Marvell mwifiex WiFi chipset and performs scanning.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 3.0 | 5.10.271 | 25217c5f6ce0 |
| 5.15 | 3.0 | 5.15.222 | 48312f0085aa |
| 6.1 | 3.0 | 6.1.189 | dccf5ecaad4d |
| 6.6 | 3.0 | 6.6.158 | c4943323fda2 |
| 6.12 | 3.0 | 6.12.112 | cb0008480ed7 |
| 6.18 | 3.0 | 6.18.54 | 9cff2f39ed38 |
| 7.2 | 3.0 | 7.2.8 | 7106ad8b74f5 |
| mainline | 3.0 | 7.3-rc4 | 3687d7d48070 |