CVE-2026-74488: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames

CVE-2026-74488: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames

mwifiex_11n_dispatch_amsdu_pkt() splits an A-MSDU with
ieee80211_amsdu_to_8023s() and walks the resulting subframes. For each
subframe it passes the subframe data pointer to
mwifiex_process_tdls_action_frame(), but pairs it with skb->len, the
length of the A-MSDU parent, instead of rx_skb->len:

	rx_skb = __skb_dequeue(&list);
	rx_hdr = (struct rx_packet_hdr *)rx_skb->data;
	if (ISSUPP_TDLS_ENABLED(priv->adapter->fw_cap_info) &&
	    ntohs(rx_hdr->eth803_hdr.h_proto) == ETH_P_TDLS) {
		mwifiex_process_tdls_action_frame(priv, (u8 *)rx_hdr,
						  skb->len);
	}

The parent is not a valid description of that buffer, and may not be
valid memory at all. ieee80211_amsdu_to_8023s() ends with

	if (!reuse_skb)
		dev_kfree_skb(skb);

and it only sets reuse_skb when the parent is linear, is not a
head_frag, and is being consumed as the *last* subframe. So when the
parent does not qualify for reuse it has already been freed, and the
read of skb->len is a use-after-free. When it is reused, skb->len is
the length of the last subframe, applied to every earlier subframe,
which over-states the buffer whenever an earlier subframe is shorter.

The callee cannot absorb a wrong length, because it derives its own
ceiling from the value it is given. Each frame type computes

	ies_len = len - sizeof(struct ethhdr) - TDLS_*_FIX_LEN;

and the element walk is then bounded entirely against that ceiling,

	for (end = pos + ies_len; pos + 1 < end; pos += 2 + pos[1]) {
		u8 ie_len = pos[1];

		if (pos + 2 + ie_len > end)
			break;

so a too-large len moves end past the end of the subframe and the walk
reads and copies beyond it. The A-MSDU layout is chosen by the sender,
which makes the difference between the last subframe and a shorter
earlier one remotely selectable. Reaching this requires TDLS support in
firmware and the TDLS ethertype on the subframe.

The other caller, mwifiex_process_rx_packet(), is correct: it passes a
pointer and a length that describe the same region of the RX buffer.

Pass rx_skb->len, the length of the subframe actually being parsed.

The Linux kernel CVE team has assigned CVE-2026-74488 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.5 with commit 776f742040ca5eb6242c60f29ac73d5752a5b621 and fixed in 6.6.151 with commit 25e5a3fe4f15e30f74eca42cbf3bcc3a3fbeda79
	Issue introduced in 4.5 with commit 776f742040ca5eb6242c60f29ac73d5752a5b621 and fixed in 6.12.103 with commit ece2ebb34247d573142617dfc534a9dc11ba59be
	Issue introduced in 4.5 with commit 776f742040ca5eb6242c60f29ac73d5752a5b621 and fixed in 6.18.44 with commit c9dcfe6b8b71369e1d732e2ff622c3696a2f032c
	Issue introduced in 4.5 with commit 776f742040ca5eb6242c60f29ac73d5752a5b621 and fixed in 7.1.8 with commit 5a21ab03829cb6d2682c127f22e2b9cd63b4393f
	Issue introduced in 4.5 with commit 776f742040ca5eb6242c60f29ac73d5752a5b621 and fixed in 7.2-rc6 with commit 99a948382af8a225e2d5e54a7052158cd6281cc6

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74488
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/25e5a3fe4f15e30f74eca42cbf3bcc3a3fbeda79
	https://git.kernel.org/stable/c/ece2ebb34247d573142617dfc534a9dc11ba59be
	https://git.kernel.org/stable/c/c9dcfe6b8b71369e1d732e2ff622c3696a2f032c
	https://git.kernel.org/stable/c/5a21ab03829cb6d2682c127f22e2b9cd63b4393f
	https://git.kernel.org/stable/c/99a948382af8a225e2d5e54a7052158cd6281cc6