CVE-2026-68197

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper<br /> <br /> mwifiex_tdls_add_ht_oper() gates its follow-the-AP-bandwidth path on<br /> bss_desc-&gt;bcn_ht_cap being present, but then dereferences a different<br /> pointer, bss_desc-&gt;bcn_ht_oper:<br /> <br /> if (ISSUPP_CHANWIDTH40(priv-&gt;adapter-&gt;hw_dot_11n_dev_cap) &amp;&amp;<br /> bss_desc-&gt;bcn_ht_cap &amp;&amp;<br /> ISALLOWED_CHANWIDTH40(bss_desc-&gt;bcn_ht_oper-&gt;ht_param))<br /> <br /> bcn_ht_cap and bcn_ht_oper are populated independently while parsing the<br /> associated AP&amp;#39;s beacon in mwifiex_update_bss_desc_with_ie(): an AP that<br /> advertises an HT Capabilities element but no HT Operation element leaves<br /> bcn_ht_cap non-NULL and bcn_ht_oper NULL. Setting up a TDLS link to a<br /> peer while associated to such an AP then dereferences the NULL<br /> bcn_ht_oper and crashes the kernel. Every other bcn_ht_oper user in the<br /> driver NULL-checks it first.<br /> <br /> Guard on the pointer that is actually dereferenced.<br /> <br /> Found by 0sec automated security-research tooling (https://0sec.ai).