CVE-2026-98186

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length

mwifiex_search_oui_in_ie() reads a pairwise-cipher (PTK) count from a

beacon/probe-response RSN or WPA information element and then walks that

many 4-byte OUIs, comparing each with memcmp(). The count comes straight

from the (attacker-supplied) IE and is never checked against the

element's own length, and the callers admit the element on element_id

alone (has_ieee_hdr() / has_vendor_hdr(), no length check). A crafted

RSN/WPA IE with a large pairwise count therefore makes the walk read up

to 255 * 4 bytes past the element -- an out-of-bounds read of the

kmemdup()'d beacon buffer, reachable from any AP whose beacon/probe

response is processed during scan-result parsing.

Pass the number of IE bytes available at the OUI list and bound the walk

to the element. Keep the length signed and reject a negative value

before any unsigned arithmetic, so a small or

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References