CVE-2026-98186

A flaw was found in the Linux kernel's mwifiex Wi-Fi driver. A nearby wireless attacker can exploit this vulnerability by broadcasting crafted Wi-Fi beacon or probe response frames containing an excessively large pairwise cipher count. Because the driver fails to validate this count against the frame element's actual length, it reads beyond the allocated buffer while processing scan results. This issue can cause a system crash, leading to a Denial of Service (DoS), or potentially disclose adjacent kernel memory.

Red Hat Product Security rates this vulnerability as Moderate because exploitation requires proximity to broadcast malicious wireless frames and specifically targets systems configured with Marvell Wi-Fi hardware. Standard Red Hat Enterprise Linux server and cloud deployments typically do not utilize Wi-Fi interfaces or load the mwifiex driver by default, substantially restricting exposure. Systems are only vulnerable when actively scanning for wireless networks in physical proximity to an attacker, with the primary consequence being a kernel crash or out-of-bounds kernel memory leak rather than direct code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.