EUVD-2026-76267
GHSA-63w9-8935-246m
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition requiring specific hardware and precise interrupt timing raises AC to H; PR:L confirmed by WiFi management privilege; full C/I/A impact via kernel stack corruption.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
wifi: mwifiex: Detach sync cmd buffer on interrupted wait
mwifiex synchronous commands keep the caller-provided data buffer in cmd_node->data_buf. Several callers pass stack-allocated objects there.
If wait_event_interruptible_timeout() is interrupted, the caller can return and release that stack object while the firmware command is still the current command. A late firmware response then reaches the normal response handler, which can copy data through cmd_node->data_buf into the stale stack address.
This fixes a stack corruption observed during repeated association and disassociation cycles. The panic trace showed the command wait being interrupted immediately before a bad pointer dereference:
cmd_wait_q terminated: -512 Unable to handle kernel paging request at virtual address 002c583837384662 Kernel panic - not syncing: stack-protector: Kernel stack is corrupted ... Tainted: [M]=MACHINE_CHECK
The fault address decodes as little-endian ASCII:
0x002c583837384662 -> "bF878X,\0"
which is a fragment of the VERSION_EXT firmware string exposed as debugfs "verext":
w8997o-V4, RF878X, FP92, 16.92.21.p153.7
The same runs also showed corrupted control data containing:
0x2400372e333531 -> "153.7\0$"
which is the tail of the same VERSION_EXT string. This points at a late VERSION_EXT response writing through a stale stack-backed data_buf after the interrupted wait returned.
After cancelling pending commands on an interrupted or timed-out wait, detach the caller-owned data buffer from the still-current command. This preserves the existing command cancellation behaviour while preventing a late response from writing through a pointer whose lifetime ended with the waiting caller.
Tested on an i.MX8MP board using an 88W8997.
AnalysisAI
Stack corruption in the Linux kernel mwifiex WiFi driver allows a local low-privileged user to corrupt kernel stack memory and trigger a kernel panic, with potential for arbitrary code execution in kernel context. The driver's synchronous firmware command path stores caller-provided stack-allocated buffers in cmd_node->data_buf; when wait_event_interruptible_timeout() is interrupted, the caller returns and reclaims its stack frame while the in-flight command node retains a stale pointer - a late firmware VERSION_EXT response then writes firmware string data through that freed stack address. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of: (1) the mwifiex kernel driver loaded and bound to a Marvell AVASTAR WiFi chipset - hardware-specific, absent on most servers and desktops not using this chipset family; (2) a local account with permission to initiate WiFi management operations (wpa_supplicant, iw, nl80211 socket access - typically any user in the netdev group or with CAP_NET_ADMIN); (3) a POSIX signal delivered to the calling thread during the firmware command wait, naturally occurring under repeated connect/disconnect cycles or deliberately triggered by the local user sending signals to their own process; (4) a concurrent asynchronous firmware response from the hardware arriving after the interrupted wait returns - a narrow, timing-dependent race window. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L) overstates exploitability on the complexity axis - this is a race condition dependent on precise signal delivery timing during an active firmware transaction, making AC:H the more accurate assessment. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patches are available: upgrade to Linux 6.12.109, 6.18.50, 7.2.4, or 7.3-rc1 using the kernel.org commit references above. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running the mwifiex WiFi driver (particularly i.MX8MP and 88W8997 hardware) and document local user access patterns. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today