CVE-2026-68197: wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper

mwifiex_tdls_add_ht_oper() gates its follow-the-AP-bandwidth path on
bss_desc->bcn_ht_cap being present, but then dereferences a different
pointer, bss_desc->bcn_ht_oper:

	if (ISSUPP_CHANWIDTH40(priv->adapter->hw_dot_11n_dev_cap) &&
	    bss_desc->bcn_ht_cap &&
	    ISALLOWED_CHANWIDTH40(bss_desc->bcn_ht_oper->ht_param))

bcn_ht_cap and bcn_ht_oper are populated independently while parsing the
associated AP's beacon in mwifiex_update_bss_desc_with_ie(): an AP that
advertises an HT Capabilities element but no HT Operation element leaves
bcn_ht_cap non-NULL and bcn_ht_oper NULL. Setting up a TDLS link to a
peer while associated to such an AP then dereferences the NULL
bcn_ht_oper and crashes the kernel. Every other bcn_ht_oper user in the
driver NULL-checks it first.

Guard on the pointer that is actually dereferenced.

Found by 0sec automated security-research tooling (https://0sec.ai).

The Linux kernel CVE team has assigned CVE-2026-68197 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.16 with commit 396939f94084d5923d558e9f22db48bc51156e47 and fixed in 6.6.148 with commit eb42c3c8fd479166c42984728754cd779c71fd60
	Issue introduced in 3.16 with commit 396939f94084d5923d558e9f22db48bc51156e47 and fixed in 6.12.101 with commit 45011e4d9ba3f2182e5df64be65888044fa20771
	Issue introduced in 3.16 with commit 396939f94084d5923d558e9f22db48bc51156e47 and fixed in 6.18.42 with commit 9375a4ea4121625ef27a46b74781cda66a5cc61b
	Issue introduced in 3.16 with commit 396939f94084d5923d558e9f22db48bc51156e47 and fixed in 7.1.6 with commit cca4398aa305c22016d1714f388e2fa6ea4e5ad4
	Issue introduced in 3.16 with commit 396939f94084d5923d558e9f22db48bc51156e47 and fixed in 7.2-rc5 with commit c3d68e294cbb6a4090bb219d3dcaca85a011809b

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68197
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/wireless/marvell/mwifiex/tdls.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/eb42c3c8fd479166c42984728754cd779c71fd60
	https://git.kernel.org/stable/c/45011e4d9ba3f2182e5df64be65888044fa20771
	https://git.kernel.org/stable/c/9375a4ea4121625ef27a46b74781cda66a5cc61b
	https://git.kernel.org/stable/c/cca4398aa305c22016d1714f388e2fa6ea4e5ad4
	https://git.kernel.org/stable/c/c3d68e294cbb6a4090bb219d3dcaca85a011809b