Re: [PATCH] wifi: nxpwifi: validate variable IE lengths in beacon parser

[Jeff Chen]

On Sun, Sep 06, 2026 at 12:53:05 PM +0100, Aamir Ahmed wrote:
> nxpwifi_update_bss_desc_with_ie() stores pointers to the HT, VHT and HE
> capability and operation elements, to the operating mode notification
> and to the 20/40 BSS coexistence element, taken from a beacon or probe
> response, without checking that each element is long enough for the
> fixed size structure or field the driver later dereferences it as.
> 

> Fixes: 73b01e57ed3e ("wifi: nxp: add nxpwifi driver for IW61x") Cc: stable@xxxxxxxxxxxxxxx 
> Assisted-by: LLM (Claude Code) Signed-off-by: Aamir Ahmed <elb12345@xxxxxxxxxxxxx> ---

Thanks for the patch.

Since nxpwifi has not appeared in any released kernel yet,
Cc: stable@xxxxxxxxxxxxxxx does not seem necessary.

The changelog looks much longer than needed.

Jeff