Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames mwifiex_11n_dispatch_amsdu_pkt() splits an A-MSDU with ieee80211_amsdu_to_8023s() and walks the resulting subframes. For each subframe it passes the subframe data pointer to mwifiex_process_tdls_action_frame(), but pairs it with skb->len, the length of the A-MSDU parent, instead of rx_skb->len: rx_skb = __skb_dequeue(&list); rx_hdr = (struct rx_packet_hdr *)rx_skb->data; if (ISSUPP_TDLS_ENABLED(priv->adapter->fw_cap_info) && ntohs(rx_hdr->eth803_hdr.h_proto) == ETH_P_TDLS) { mwifiex_process_tdls_action_frame(priv, (u8 *)rx_hdr, skb->len); } The parent is not a valid description of that buffer, and may not be valid memory at all. ieee80211_amsdu_to_8023s() ends with if (!reuse_skb) dev_kfree_skb(skb); and it only sets reuse_skb when the parent is linear, is not a head_frag, and is being consumed as the *last* subframe. So when the parent does not qualify for reuse it has already been freed, and the read of skb->len is a use-after-free. When it is reused, skb->len is the length of the last subframe, applied to every earlier subframe, which over-states the buffer whenever an earlier subframe is shorter. The callee cannot absorb a wrong length, because it derives its own ceiling from the value it is given. Each frame type computes ies_len = len - sizeof(struct ethhdr) - TDLS_*_FIX_LEN; and the element walk is then bounded entirely against that ceiling, for (end = pos + ies_len; pos + 1 < end; pos += 2 + pos[1]) { u8 ie_len = pos[1]; if (pos + 2 + ie_len > end) break; so a too-large len moves end past the end of the subframe and the walk reads and copies beyond it. The A-MSDU layout is chosen by the sender, which makes the difference between the last subframe and a shorter earlier one remotely selectable. Reaching this requires TDLS support in firmware and the TDLS ethertype on the subframe. The other caller, mwifiex_process_rx_packet(), is correct: it passes a pointer and a length that describe the same region of the RX buffer. Pass rx_skb->len, the length of the subframe actually being parsed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-15T13:17:53.690Z",
  "pubdate": "2026-08-15T13:17:53.690Z",
  "executiveSummary": "A use-after-free vulnerability exists in the Linux kernel mwifiex Wi-Fi driver when parsing A-MSDU TDLS frames. The vulnerability arises from an incorrect length and buffer reference during subframe iteration, where the parent skb->len is passed instead of the individual subframe rx_skb->len. Depending on memory reuse conditions enforced by ieee80211_amsdu_to_8023s(), the parent socket buffer may already be freed prior to access, leading to a use-after-free condition. When the parent buffer is reused, an oversized length is applied to smaller subframes, causing out-of-bounds memory reads and parsing logic corruption.\nThe impact includes potential kernel memory disclosure, denial of service through kernel crashes, or remote code execution depending on underlying heap layouts. The vulnerability affects systems running the Linux kernel utilizing the mwifiex driver with TDLS support enabled in firmware. Exploitation requires an attacker to be within wireless range capable of transmitting specially crafted A-MSDU frames containing the TDLS ethertype, allowing remote triggerability over the air without requiring authentication or privileged access.",
  "technicalDetails": "The root cause of the vulnerability resides in the mwifiex_11n_dispatch_amsdu_pkt() function within the wifi: mwifiex driver. When splitting an A-MSDU frame using ieee80211_amsdu_to_8023s() and iterating over the resulting subframes, the driver incorrectly passes the parent socket buffer length (skb->len) rather than the specific subframe length (rx_skb->len) into mwifiex_process_tdls_action_frame().\nUnder memory management rules implemented by ieee80211_amsdu_to_8023s(), the parent skb is freed via dev_kfree_skb(skb) unless it qualifies for reuse (linear, not a head_frag, and consumed as the last subframe). When the parent does not qualify for reuse, it is freed before the loop completes its iterations, causing subsequent reads of skb->len to trigger a use-after-free condition. When the parent is reused, its larger length is applied to preceding, shorter subframes, severely over-stating the actual buffer size.\nThe callee mwifiex_process_tdls_action_frame() derives its internal bounding ceiling based entirely on the supplied length parameter. It computes ies_len = len - sizeof(struct ethhdr) - TDLS_*_FIX_LEN and bounds the Information Element (IE) walk loop against this derived ceiling using for (end = pos + ies_len; pos + 1 < end; pos += 2 + pos[1]). An inflated length parameter causes the end pointer to move past the true boundaries of the subframe buffer. Consequently, the IE element walk reads and copies out-of-bounds kernel memory beyond the actual payload allocation.\nThe attack flow proceeds as follows: an attacker within wireless range crafts a malicious A-MSDU frame containing TDLS action frames with manipulated subframe dimensions. The firmware processes the TDLS ethertype on the subframe, routing execution into the vulnerable mwifiex_process_tdls_action_frame() parsing routine with mismatched buffer boundaries. The out-of-bounds read accesses adjacent heap allocations or triggers a use-after-free fault against recently deallocated skb structures. Network exposure is local over Wi-Fi, requiring no prior authentication or user interaction, but is contingent upon firmware-level TDLS support and matching ethertype conditions."
}