The Linux kernel mwifiex wifi driver used synchronous commands that keep caller-provided data buffers in cmd_node->data_buf, with some callers passing stack-allocated objects. If wait_event_interruptible_timeout() is interrupted, the caller can return and release the stack object while the firmware command remains current. A late firmware response then writes through the stale stack pointer, causing stack corruption and kernel panic. The fix cancels pending commands on interrupted or timed-out waits and detaches the caller-owned data buffer from the current command, preventing late responses from writing through pointers whose lifetime has ended. This vulnerability was observed during repeated association and disassociation cycles on an i.MX8MP board using an 88W8997 wifi chip.

This vulnerability can cause kernel stack corruption leading to kernel panic and system instability. It affects the mwifiex wifi driver in the Linux kernel and can be triggered by interrupted waits during firmware command processing. There is no indication of remote code execution or privilege escalation from the provided data, but the kernel panic can cause denial of service.

A fix has been implemented that detaches the caller-owned data buffer from the command after an interrupted or timed-out wait, preventing late firmware responses from corrupting stale stack memory. Users should update to the Linux kernel version that includes this fix once available. Patch status is not explicitly stated in the input data; check the vendor advisory or Linux kernel mailing lists for the official patch and update guidance.