SECUFOCUSNOW
Home›CVE index›CVE-2026-74488
ReviewHigh

CVE-2026-74488

Linux

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames mwifiex_11n_dispatch_amsdu_pkt() splits an A-MSDU with ieee80211_amsdu_to_8023s() and walks the resulting subframes. For each subframe it passes the subframe data pointer to mwifiex_process_tdls_action_frame(), but pairs it with skb->len, the length of the A-MSDU parent, instead of rx_skb->len: rx_skb = __skb_dequeue(&list); rx_hdr = (struct rx_packet_hdr *)rx_skb->data; if (ISSUPP_TDLS_ENABLED(priv->adapter->fw_cap_info) && ntohs(rx_hdr->eth803_hdr.h_pr...

CVSS
8.8
EPSS
-
- percentile
CISA KEV
Not listed
Published
2026.08.15
PRIORITY ASSESSMENT

Review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability-
Technical severityCVSS 8.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames mwifiex_11n_dispatch_amsdu_pkt() splits an A-MSDU with ieee80211_amsdu_to_8023s() and walks the resulting subframes. For each subframe it passes the subframe data pointer to mwifiex_process_tdls_action_frame(), but pairs it with skb->len, the length of the A-MSDU parent, instead of rx_skb->len: rx_skb = __skb_dequeue(&list); rx_hdr = (struct rx_packet_hdr *)rx_skb->data; if (ISSUPP_TDLS_ENABLED(priv->adapter->fw_cap_info) && ntohs(rx_hdr->eth803_hdr.h_pr...

Affected product and versions

Product
Linux
Affected versions
>= 776f742040ca5eb6242c60f29ac73d5752a5b621 < 707664027bb9307f7268eda403af7c4ccd9b8644, >= 776f742040ca5eb6242c60f29ac73d5752a5b621 < 3b02275833a0d3e6583627995d614fa99bdf364f, >= 776f742040ca5eb6242c60f29ac73d5752a5b621 < a1f0f7dc7eb15754e6931b433edb7beb754c996a, >= 776f742040ca5eb6242c60f29ac73d5752a5b621 < 25e5a3fe4f15e30f74eca42cbf3bcc3a3fbeda79, >= 776f742040ca5eb6242c60f29ac73d5752a5b621 < ece2ebb34247d573142617dfc534a9dc11ba59be, >= 776f742040ca5eb6242c60f29ac73d5752a5b621 < c9dcfe6b8b71369e1d732e2ff622c3696a2f032c, >= 776f742040ca5eb6242c60f29ac73d5752a5b621 < 5a21ab03829cb6d2682c127f22e2b9cd63b4393f, >= 776f742040ca5eb6242c60f29ac73d5752a5b621 < 99a948382af8a225e2d5e54a7052158cd6281cc6, >= 4.5
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
Not available