CVE-2026-98184 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: mwifiex: prevent authentication frame length truncation
mwifiex_cfg80211_authenticate() derives the authentication frame length from req->ie_len and req->auth_data_len, both of type size_t, but stores it in a u16.
NL80211_ATTR_AUTH_DATA only has a minimum length policy. Since nla_len is a u16, a single attribute can carry up to 65531 bytes of payload, so the sum can exceed U16_MAX before it is assigned to pkt_len. The truncated pkt_len determines the skb frame area, while the copy length remains req->auth_data_len - 4, resulting in a heap buffer overflow.
For example, with auth_data_len equal to 65510 and no IEs, the sum is 65546. It is truncated to 10 and then reduced by four to 6. The driver appends only six bytes to the skb with skb_put(), but then copies 65506 user-provided bytes into the authentication body.
Reaching this path requires CAP_NET_ADMIN in the user namespace owning the network namespace, an up station netdev, and a suitable BSS/SAE authentication request.
Compute the length in size_t, reject values that cannot be represented by the firmware's u16 frame length field, and only then assign it to pkt_len.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified within the Linux kernel’s mwifiex wireless driver represents a critical heap buffer overflow resulting from improper type conversion during authentication frame processing. The flaw resides in the mwifiex_cfg80211_authenticate function, which is responsible for handling IEEE 802.11 authentication requests received via the nl80211 interface. Specifically, the code calculates the total length of an authentication frame by summing two values: req->ie_len and req->auth_data_len. Both of these source variables are defined as size_t, a type capable of representing very large memory offsets on 64-bit systems. However, the resulting sum is stored in a variable named pkt_len, which is declared as u16, an unsigned 16-bit integer with a maximum value of 65535. This mismatch between the source data types and the destination storage type creates a classic arithmetic overflow condition where large input values wrap around to small positive integers without triggering any error checks or warnings from the compiler or runtime environment.
The operational impact of this truncation is severe because it directly leads to a heap buffer overflow that can be exploited by local users with specific privileges. The nl80211 subsystem allows network configuration attributes, including authentication data, to carry payloads up to 65531 bytes due to the u16 length field in netlink attribute headers. When an attacker provides auth_data_len values near this upper limit, such as 65510 bytes, and combines them with any non-zero IE length, the sum exceeds the capacity of a u16 variable. For instance, if the total calculated length is 65546, it truncates to 10 when stored in pkt_len. The driver then subtracts four bytes for header overhead, resulting in a final copy size of only six bytes being allocated via skb_put(). Despite this small allocation, the subsequent memory copy operation proceeds using the original untruncated req->auth_data_len value minus four, attempting to write approximately 65506 bytes into a buffer that was sized for merely six bytes. This discrepancy allows an attacker to overwrite adjacent heap memory structures, potentially leading to arbitrary code execution or kernel panic depending on the layout of the heap at runtime.
Accessing this vulnerability requires specific conditions and privileges within the Linux security model. The attacker must possess CAP_NET_ADMIN capability in the user namespace that owns the network namespace where the operation is performed. Additionally, there must be an up station network device present to receive the frame, and the request must correspond to a valid BSS or SAE authentication scenario compatible with the mwifiex driver’s expectations. While this restricts exploitation to local users who have already gained significant administrative control over their namespace, it remains a serious issue because container escapes are possible if an attacker can leverage kernel memory corruption to break out of isolated environments. The vulnerability aligns with CWE-190 Integer Overflow or Wraparound and CWE-787 Out-of-bounds Write in the Common Weakness Enumeration framework. From a tactical perspective, this exploitation technique falls under ATT&CK T1203 Exploitation for Client Execution if it leads to local privilege escalation through binary execution, though primarily it is classified as an integrity violation via memory corruption.
To mitigate this vulnerability, developers must enforce strict type safety during length calculations before assigning values to fixed-width integer fields. The recommended fix involves computing the total frame length using size_t arithmetic to preserve precision and then explicitly checking if the result exceeds U16_MAX or any other relevant limit imposed by the firmware’s protocol constraints. If the calculated length is too large, the function should reject the request immediately rather than allowing truncation to proceed. This defensive programming approach ensures that only valid, non-truncated lengths are passed to memory allocation routines like skb_put(). By validating input sizes against their destination container capacities before any arithmetic operations or assignments occur, the kernel prevents the discrepancy between allocated buffer size and actual data copy length that characterizes this heap overflow. Maintaining consistent use of appropriate integer types throughout the processing pipeline is essential for preventing such logic errors in network drivers where external inputs directly influence memory management decisions.