Executive brief
A security vulnerability has been identified in the NXP Wi-Fi driver used in various embedded systems and devices. An attacker with administrative access to the local system could exploit this flaw to crash the device or potentially execute unauthorized code at the highest privilege level (the operating system kernel). This could lead to a complete system takeover or a persistent denial of service.
Technical details
A stack-based buffer overflow (CWE-121) exists in the NXP moal.ko Wi-Fi kernel driver version 5.1.7.10. The vulnerability is located in the parse_cfg_get_line function within mlinux/moal_init.c, which is called by woal_setup_module_param. The root cause is a lack of bounds checking when reading configuration file lines into a fixed-size stack buffer (MAX_LINE_LEN) via the mod_para parameter. A local attacker with high privileges can provide a specially crafted configuration file with an overlong line to overflow the stack, leading to a kernel panic or arbitrary code execution in kernel space. NXP has confirmed the vulnerability and released a fix.
Affected products
- NXP moal.ko Wi-Fi driver 5.1.7.10 (FW v17.92.1.p149.43 to v17.92.1.p149.157)
Timeline
- 2026-05-13: advisory: NVD publication date
- 2026-05-13: disclosed: Public disclosure by researcher