CVE-2026-98184

A flaw was found in the Linux kernel's mwifiex driver. An integer truncation vulnerability occurs during authentication frame length calculation, causing the driver to allocate an undersized memory buffer. A local attacker with network administration privileges can exploit this issue by submitting a crafted authentication request with oversized authentication data, triggering a heap-based buffer overflow that may result in a denial of service (DoS) or potential arbitrary code execution.

A heap buffer overflow in the mwifiex authentication path occurs because authentication frame length is calculated from size_t values and truncated to a u16 pkt_len. A local attacker can provide oversized NL80211 authentication data so the driver allocates a small skb area but copies the original larger user controlled authentication payload into it. For the CVSS the PR:L is used because triggering requires CAP_NET_ADMIN in the user namespace that owns the network namespace. This capability can be available to a container root or a delegated service account and is not necessarily equivalent to full host administration. The issue is not directly network reachable because the overflowing data is supplied through a local nl80211 request. An active station interface and a suitable BSS SAE authentication request are also required. Impact includes kernel crash and may include confidentiality integrity impact or local privilege escalation due to the explicit controlled heap memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.