From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A8BA73EC2F8 for ; Sat, 15 Aug 2026 12:29:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786796980; cv=none; b=gxOSsGuh6kvnblPEsvTApics6QwXerqmKzKLnFqGSal+voIU3i3wjLqlN407E2DJM42eK1MgAQMScOz4ebGEbU0Ydmh7UD1ns+9M3wVmHtYcjFl9h4EluEQ+a8FQWZqD32ExI7DXMsHXLfvbXM0c4AhysR39xi1Q/BnhRNAWJgE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786796980; c=relaxed/simple; bh=UTeFNFwxwMDkx1H1acI+ZIddCSSuGCEBcUBwvIUsjUg=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=d9QjFrRIMOHW7mILUWtVIoDxHTz+w2TWT7n0UghaLAGTf5zkSvdjKGo9tsAo2+O33xrJ0qiDJ8fxy2b6GmAf8p07S94S54P/VMr1wZ0VCgbyvVA08KmfkZb8J+JS7+nrsyKhIu+pgdapz1ckZ9/nhLF+SHvz3YqwERYNNbDayWI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=cYy7lEBV; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="cYy7lEBV" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0E4841F000E9; Sat, 15 Aug 2026 12:29:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786796979; bh=MbpsIboT8vGpSaL4LE+cO/tu7TUdld2xjRgh+kBGJNM=; h=From:To:Cc:Subject:Date:Reply-To; b=cYy7lEBV2SfFeUHT+vGotbE3yrBdAuWtFNJ55OiObQLO/0PzWk+kdxY1qgREA+cYn taQCRVhd94fwlUQnb2+z7rPniC9jVWmCbOPq5DRogbc5UNzDbk+2vI6IUcYzN+vDMk IeWgKqPdnW69JNfNAjiYUweCTDL7YnKmTHUGEuGE= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-74488: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames Date: Sat, 15 Aug 2026 21:26:09 +0900 Message-ID: <2026081538-CVE-2026-74488-bf0e@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4608; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=vWAleccNlJ00hJ+Gh3DfTkMHUAK4oLPAEXVpG1vPp2A=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkNUYdytXaHnFK4JjFdfE5d1CnZ2sTiuTubFy6SFsyfp ypyTsK4I5aFQZCJQVZMkeXLNp6j+ysOKXoZ2p6GmcPKBDKEgYtTACbCMJlhwU7ug5VKkxbMueYk qfqi4tN6hSrZWoZ5NiJ/KzY7rm8SXfk6oaD9BvfRF7P1AQ== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames mwifiex_11n_dispatch_amsdu_pkt() splits an A-MSDU with ieee80211_amsdu_to_8023s() and walks the resulting subframes. For each subframe it passes the subframe data pointer to mwifiex_process_tdls_action_frame(), but pairs it with skb->len, the length of the A-MSDU parent, instead of rx_skb->len: rx_skb = __skb_dequeue(&list); rx_hdr = (struct rx_packet_hdr *)rx_skb->data; if (ISSUPP_TDLS_ENABLED(priv->adapter->fw_cap_info) && ntohs(rx_hdr->eth803_hdr.h_proto) == ETH_P_TDLS) { mwifiex_process_tdls_action_frame(priv, (u8 *)rx_hdr, skb->len); } The parent is not a valid description of that buffer, and may not be valid memory at all. ieee80211_amsdu_to_8023s() ends with if (!reuse_skb) dev_kfree_skb(skb); and it only sets reuse_skb when the parent is linear, is not a head_frag, and is being consumed as the *last* subframe. So when the parent does not qualify for reuse it has already been freed, and the read of skb->len is a use-after-free. When it is reused, skb->len is the length of the last subframe, applied to every earlier subframe, which over-states the buffer whenever an earlier subframe is shorter. The callee cannot absorb a wrong length, because it derives its own ceiling from the value it is given. Each frame type computes ies_len = len - sizeof(struct ethhdr) - TDLS_*_FIX_LEN; and the element walk is then bounded entirely against that ceiling, for (end = pos + ies_len; pos + 1 < end; pos += 2 + pos[1]) { u8 ie_len = pos[1]; if (pos + 2 + ie_len > end) break; so a too-large len moves end past the end of the subframe and the walk reads and copies beyond it. The A-MSDU layout is chosen by the sender, which makes the difference between the last subframe and a shorter earlier one remotely selectable. Reaching this requires TDLS support in firmware and the TDLS ethertype on the subframe. The other caller, mwifiex_process_rx_packet(), is correct: it passes a pointer and a length that describe the same region of the RX buffer. Pass rx_skb->len, the length of the subframe actually being parsed. The Linux kernel CVE team has assigned CVE-2026-74488 to this issue. Affected and fixed versions =========================== Issue introduced in 4.5 with commit 776f742040ca5eb6242c60f29ac73d5752a5b621 and fixed in 6.6.151 with commit 25e5a3fe4f15e30f74eca42cbf3bcc3a3fbeda79 Issue introduced in 4.5 with commit 776f742040ca5eb6242c60f29ac73d5752a5b621 and fixed in 6.12.103 with commit ece2ebb34247d573142617dfc534a9dc11ba59be Issue introduced in 4.5 with commit 776f742040ca5eb6242c60f29ac73d5752a5b621 and fixed in 6.18.44 with commit c9dcfe6b8b71369e1d732e2ff622c3696a2f032c Issue introduced in 4.5 with commit 776f742040ca5eb6242c60f29ac73d5752a5b621 and fixed in 7.1.8 with commit 5a21ab03829cb6d2682c127f22e2b9cd63b4393f Issue introduced in 4.5 with commit 776f742040ca5eb6242c60f29ac73d5752a5b621 and fixed in 7.2-rc6 with commit 99a948382af8a225e2d5e54a7052158cd6281cc6 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-74488 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/25e5a3fe4f15e30f74eca42cbf3bcc3a3fbeda79 https://git.kernel.org/stable/c/ece2ebb34247d573142617dfc534a9dc11ba59be https://git.kernel.org/stable/c/c9dcfe6b8b71369e1d732e2ff622c3696a2f032c https://git.kernel.org/stable/c/5a21ab03829cb6d2682c127f22e2b9cd63b4393f https://git.kernel.org/stable/c/99a948382af8a225e2d5e54a7052158cd6281cc6