CVE-2026-68326: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-68326 Overview

CVE-2026-68326 is a Linux kernel vulnerability in the mwifiex Wi-Fi driver that handles Marvell/NXP wireless chipsets over USB, SDIO, and PCIe. The flaw resides in mwifiex_process_uap_event(), which processes the EVENT_UAP_STA_ASSOC event when the driver operates in Access Point (AP) or micro-AP (uAP) mode. The handler trusts a firmware-supplied event->len field without validation, leading to a slab out-of-bounds read and potential integer underflow. A malicious or malfunctioning mwifiex device on an adjacent network can trigger the condition during station association.

Critical Impact
A crafted association event can cause a slab-out-of-bounds read in cfg80211_find_ie() and leak stale kernel slab memory into NL80211_CMD_NEW_STATION notifications, enabling kernel information disclosure and potential memory corruption.

Affected Products

Linux kernel mwifiex driver (Marvell/NXP Wi-Fi chipsets over USB, SDIO, PCIe)
Systems using mwifiex in AP or uAP mode with ap_11n_enabled
Multiple upstream Linux kernel branches (fixes issued across five stable trees)

Discovery Timeline

2026-08-10 - CVE-2026-68326 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68326

Vulnerability Analysis

The mwifiex_process_uap_event() function handles EVENT_UAP_STA_ASSOC by exposing the (re)association request Information Elements (IEs) that firmware copies into the event buffer. It computes assoc_req_ies_len by subtracting a header offset from event->len, a firmware-controlled 16-bit value. Neither the subtraction nor the resulting length is validated against the fixed-size adapter->event_body[MAX_EVENT_SIZE] buffer.

When ap_11n_enabled is set, mwifiex_set_sta_ht_cap() walks the IEs using cfg80211_find_ie(). The internal for_each_element() iterator dereferences element headers past the end of the slab-allocated struct mwifiex_adapter, producing a slab-out-of-bounds read detectable by Kernel Address Sanitizer (KASAN). The same corrupted length is passed to cfg80211_new_sta(), which copies stale slab bytes into userspace via the NL80211_CMD_NEW_STATION netlink notification.

Root Cause

The root cause is missing input validation on device-supplied data combined with an unchecked integer subtraction [CWE-125, CWE-191]. When event->len is smaller than the header offset, the signed subtraction goes negative and wraps to a large size_t. When event->len exceeds the bytes actually received, the computed IE region extends past event_body[] into adjacent slab memory.

Attack Vector

Exploitation requires a malicious or compromised mwifiex device delivering a crafted EVENT_UAP_STA_ASSOC while the interface is in AP or uAP mode. This includes rogue USB dongles, tampered SDIO modules, or a compromised PCIe firmware image. The attack surface is adjacent-network in scope because the trigger is a wireless association event, but the attacker must control or influence the firmware event payload delivered over the host transport.

The vulnerability mechanism is described in prose because verified proof-of-concept code is not publicly available. See the upstream fix commits linked in the references for the exact validation logic applied to event->len.

Detection Methods for CVE-2026-68326

Indicators of Compromise

KASAN reports flagging slab-out-of-bounds in cfg80211_find_ie originating from mwifiex_set_sta_ht_cap
Unexpected kernel oops or panic messages referencing mwifiex_process_uap_event in dmesg
Anomalous NL80211_CMD_NEW_STATION notifications containing malformed or oversized IE payloads
Presence of unpatched mwifiex module versions on hosts running hostapd or uAP configurations

Detection Strategies

Enable KASAN on test kernels to surface out-of-bounds reads triggered by association events
Audit loaded kernel modules for mwifiex and correlate with kernel version against upstream stable trees carrying the fix
Monitor kernel ring buffer telemetry for warnings from cfg80211_find_ie and mwifiex event paths
Inspect nl80211 event streams for association notifications with abnormally large assoc_req_ies_len values

Monitoring Recommendations

Forward kernel logs to a centralized logging pipeline and alert on mwifiex or KASAN keywords
Track hostapd process crashes on systems running Marvell/NXP Wi-Fi hardware in AP mode
Inventory embedded and IoT devices using mwifiex firmware and monitor for unexpected reboots or driver reloads

How to Mitigate CVE-2026-68326

Immediate Actions Required

Apply the upstream Linux kernel patches from the referenced stable commits to all affected kernels
Disable AP or uAP mode on mwifiex interfaces until patched kernels are deployed
Restrict physical and logical access to USB and SDIO slots on systems using mwifiex hardware
Prioritize patching for embedded appliances, single-board computers, and IoT gateways with Marvell/NXP Wi-Fi radios

Patch Information

The fix validates event->len before use, rejecting values that underflow the header offset or place IEs outside the event_body[MAX_EVENT_SIZE] buffer. Patches have been merged across multiple stable branches. See the upstream commits: Commit a3f47d7c, Commit ad26c75a, Commit b6766d7e, Commit d21464d9, and Commit f0858bfc.

Workarounds

Blacklist the mwifiex module on hosts that do not require Marvell/NXP wireless functionality
Operate mwifiex interfaces in station (client) mode only, avoiding AP and uAP configurations
Isolate systems running vulnerable mwifiex firmware on segmented management networks
Disable ap_11n_enabled in hostapd configurations to reduce the exposure surface until patches are applied

bash

# Blacklist the mwifiex module until patched
echo "blacklist mwifiex" | sudo tee /etc/modprobe.d/blacklist-mwifiex.conf
echo "blacklist mwifiex_usb" | sudo tee -a /etc/modprobe.d/blacklist-mwifiex.conf
echo "blacklist mwifiex_sdio" | sudo tee -a /etc/modprobe.d/blacklist-mwifiex.conf
echo "blacklist mwifiex_pcie" | sudo tee -a /etc/modprobe.d/blacklist-mwifiex.conf
sudo update-initramfs -u
sudo reboot