CVE-2026-74488

A flaw was found in the Linux kernel's mwifiex Wi-Fi driver. When parsing Tunneled Direct Link Setup (TDLS) frames within an Aggregated MAC Service Data Unit (A-MSDU), the driver incorrectly uses the length of the parent frame instead of the subframe. This error can lead to a use-after-free vulnerability or an out-of-bounds read, allowing a remote attacker to cause memory corruption. This issue requires TDLS support in the firmware and specific TDLS frame types.

Red Hat has rated this vulnerability as having an Important severity impact because adjacent attackers transmitting malformed TDLS network frames can trigger kernel heap memory corruption, potentially leading to system crashes or arbitrary kernel code execution. While the blast radius includes full kernel compromise, exposure is limited to environments utilizing Marvell wireless adapters with firmware-level TDLS capabilities enabled. Default enterprise server installations that do not utilize Marvell Wi-Fi devices remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, prevent the mwifiex driver from loading onto the system by blacklisting the kernel module.

1. Create a configuration file in /etc/modprobe.d to prevent the module from loading:

echo "install mwifiex /bin/true" > /etc/modprobe.d/disable-mwifiex.conf

2. If the module is already loaded, remove it:

modprobe -r mwifiex

Warning: If the module is currently in use or cannot be unloaded dynamically, a system reboot is required to apply the change. Disabling this driver will cause any Marvell wireless network adapters on the host to stop functioning.