PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-68326 Linux CVE debrief

A slab-out-of-bounds read vulnerability exists in the Linux kernel's mwifiex driver when handling uAP association event IEs. The firmware-supplied event length is not validated, allowing for out-of-bounds reads when walking the IEs. This vulnerability affects Linux kernel versions and requires patching and verification of Linux kernel versions and firmware updates. The vulnerability is caused by the lack of validation of the event length supplied by the firmware, which allows for out-of-bounds reads when walking the IEs. The affected code is in the mwifiex_process_uap_event() function. Linux kernel maintainers, Linux distribution maintainers, and users of affected Linux kernel

Vendor
Linux
Product
Unknown
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-10
Original CVE updated
2026-10-19
Advisory published
2026-08-10
Advisory updated
2026-10-19

Who should care

Linux kernel maintainers, Linux distribution maintainers, and users of affected Linux kernel versions should assess exposure and apply patches. Linux kernel versions are affected, and patching and verification of Linux kernel versions and firmware updates are required. The vulnerability is caused by the lack of validation of the event length supplied by the firmware, which allows for out-of-bounds reads when walking the IEs.

Why it matters

A slab-out-of-bounds read vulnerability in the Linux kernel's mwifiex driver requires patching and verification of Linux kernel versions and firmware updates.

  • Potential for denial of service due to out-of-bounds reads
  • Possible information disclosure due to exposure of sensitive data
  • Requires verification of Linux kernel versions and firmware updates

Technical summary

The vulnerability exists in the mwifiex_process_uap_event() function, which handles EVENT_UAP_STA_ASSOC events. The firmware-supplied event length is not validated, allowing for out-of-bounds reads when walking the IEs. This can lead to a slab-out-of-bounds read vulnerability. The affected code is in the mwifiex_process_uap_event() function. Linux kernel versions are affected, and patching and verification of Linux kernel versions and firmware updates are required. The vulnerability is caused by the lack of validation of the event length supplied by the firmware.

Defensive priority

High-priority patching recommended for Linux kernel versions affected by this vulnerability.

Recommended defensive actions

  • Apply patches from Linux kernel maintainers
  • Inventory and assess Linux kernel versions for exposure
  • Monitor for firmware updates and additional patches
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the lack of validation of the event length supplied by the firmware. This allows for out-of-bounds reads when walking the IEs. The affected code is in the mwifiex_process_uap_event() function. The firmware-supplied event length is not validated, allowing for out-of-bounds reads when walking the IEs. Linux kernel versions are affected, and patching and verification of Linux kernel versions and firmware updates are required.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-68326 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-68326

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-68326 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-68326

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • wifi: mwifiex: bound uAP association event IEs to the event buffer

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/68xxx/CVE-2026-68326.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/a616616b938f7922a93e79bef16b4643c57c0922

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/1ae00b6d9a6c82eb3de151d9b04ed59e06cc100f

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/e7e93d3e8c240bdb70c41e79d169d74dfb442843

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/a3f47d7c75ddad1a14621a309286f9fae3cba191

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ad26c75ae25749313248f06510ebe43b5bf4adcc

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d21464d93f8ba464dc3d7b4b31c6e0adcd9f659c

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/b6766d7ea43edf5de9d5a572bc58b631d09efe4b

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.