CVE-2026-68326

A flaw was found in the Linux kernel's mwifiex Wi-Fi driver. A malicious or malfunctioning mwifiex device, operating in Access Point (AP) or micro-AP (uAP) mode, can provide a crafted event with an invalid length value. This unchecked length can lead to an out-of-bounds read or integer underflow, potentially disclosing sensitive information from the kernel's memory or copying stale data into network notifications.

This vulnerability is rated as having Moderate impact for Red Hat Enterprise Linux because successful exploitation requires either a compromised firmware environment or an adversarial Marvell Wi-Fi interface attached to the host, combined with an active access point configuration. Standard enterprise server deployments rarely incorporate wireless hardware or operate systems as wireless access points, greatly limiting real-world exposure. Even when such hardware is present, exploitation is confined to systems actively operating in micro-AP mode, preventing widespread or unauthenticated remote impact across typical configurations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.