CVE-2026-68197: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-68197 Overview

CVE-2026-68197 is a NULL pointer dereference vulnerability in the Linux kernel mwifiex Wi-Fi driver. The flaw resides in mwifiex_tdls_add_ht_oper(), which gates a code path on the presence of bss_desc->bcn_ht_cap but then dereferences a separate pointer, bss_desc->bcn_ht_oper. When a station is associated with an access point that advertises an HT Capabilities element without an HT Operation element, initiating a Tunneled Direct Link Setup (TDLS) link crashes the kernel. The issue was discovered by 0sec automated security-research tooling.

Critical Impact
A malicious or misconfigured access point can trigger a kernel NULL pointer dereference on associated Linux clients using mwifiex hardware, resulting in denial of service when TDLS is attempted.

Affected Products

Linux kernel mwifiex wireless driver (Marvell/NXP Wi-Fi chipsets)
Multiple Linux kernel stable branches (see kernel.org commits)
Systems using TDLS with mwifiex-based Wi-Fi adapters

Discovery Timeline

2026-08-10 - CVE-2026-68197 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68197

Vulnerability Analysis

The mwifiex driver parses beacon information elements from associated access points in mwifiex_update_bss_desc_with_ie(). This function populates bcn_ht_cap and bcn_ht_oper fields on the BSS descriptor independently. An access point may legitimately advertise an HT Capabilities information element while omitting the HT Operation element, producing a state where bcn_ht_cap is non-NULL and bcn_ht_oper is NULL.

When a user establishes a TDLS peer link while associated to such an access point, mwifiex_tdls_add_ht_oper() proceeds down the follow-the-AP-bandwidth path based only on the bcn_ht_cap check and then dereferences bcn_ht_oper->ht_param. The dereference of the NULL pointer crashes the kernel.

Root Cause

The root cause is a mismatch between the guard condition and the dereferenced pointer. The conditional expression validates bss_desc->bcn_ht_cap but immediately reads bss_desc->bcn_ht_oper->ht_param without a corresponding NULL check. Every other consumer of bcn_ht_oper in the driver validates the pointer first, making this an inconsistency in defensive coding [CWE-476].

Attack Vector

The attack requires the victim to associate with an access point that advertises HT Capabilities but omits HT Operation. An attacker operating a rogue access point can craft beacons meeting this criteria. When the associated client initiates TDLS with any peer, the kernel dereferences the NULL bcn_ht_oper pointer and panics. The vulnerability produces a denial-of-service condition on the victim host.

The upstream fix, described in the kernel commit series, changes the guard condition to test the pointer that is actually dereferenced. See the kernel commit for the patch details.

Detection Methods for CVE-2026-68197

Indicators of Compromise

Kernel panic or oops messages referencing mwifiex_tdls_add_ht_oper in the call stack
System crashes on Linux hosts using mwifiex drivers following TDLS peer setup attempts
Unexpected reboots correlated with association to access points advertising incomplete HT information elements

Detection Strategies

Inventory Linux endpoints running mwifiex kernel modules and compare running kernel versions against the fixed commits on kernel.org
Parse dmesg and journalctl output for NULL pointer dereference traces containing mwifiex_tdls symbols
Monitor wireless event logs for TDLS setup failures immediately preceding kernel faults

Monitoring Recommendations

Forward kernel crash telemetry and kdump artifacts to a central log platform for correlation
Alert on repeated mwifiex driver faults across a fleet, which may indicate a rogue AP within radio range
Track wireless client association events and cross-reference with subsequent host crash reports

How to Mitigate CVE-2026-68197

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the kernel.org commits for CVE-2026-68197
Update to a distribution kernel package that incorporates the fix from your Linux vendor
Disable TDLS on affected mwifiex clients until the patched kernel is deployed

Patch Information

The fix is committed to the Linux stable trees. Relevant commits include 45011e4d9ba3, 9375a4ea4121, c3d68e294cbb, cca4398aa305, and eb42c3c8fd47. The patch replaces the guard on bcn_ht_cap with a check on the actual dereferenced pointer bcn_ht_oper. Refer to the Linux kernel git repository for the complete change.

Workarounds

Unload the mwifiex module (modprobe -r mwifiex) on systems that do not require Marvell/NXP Wi-Fi
Avoid associating with untrusted or unknown access points until the kernel is patched
Disable TDLS via iw or NetworkManager configuration to prevent the vulnerable code path from executing

bash

# Disable TDLS on a wireless interface using iw
sudo iw dev wlan0 station dump
sudo iw dev wlan0 set power_save on

# Unload the mwifiex driver as a temporary workaround
sudo modprobe -r mwifiex_pcie mwifiex_sdio mwifiex

# Verify installed kernel package includes the fix
uname -r
apt list --installed 2>/dev/null | grep linux-image