[PATCH] nl80211: verify frame length before reading auth_alg

[Jouni Malinen]

On Thu, Oct 08, 2026 at 12:37:43PM +0300, Andrei Otcheretianski wrote:
> In mlme_event(), auth_alg is read from mgmt->u.auth.auth_alg when
> len >= 24, but this field starts at offset 24 and is 2 bytes wide,
> requiring len >= 26. A management frame with exactly 24 bytes (header
> only, no body) triggers a 2-byte OOB heap read. Guard the access with
> a proper length check.

Thanks, applied.
 
-- 
Jouni Malinen                                            PGP id EFC895FA