CVE-2026-93784 - Vulnerability Details

- wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie()

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie()

The KASAN allocation trace shows that a malformed IE buffer is
stored via SIOCSIWGENIE (cfg80211_wext_siwgenie()) without any
validation. The crash trace shows that a subsequent SIOCSIWESSID
triggers a connection attempt which calls cfg80211_sme_get_conn_ies()
to process the stored IE buffer, causing:

- An out-of-bounds read in skip_ie() which reads ies[pos+1]
(the length byte) past the end of the 1-byte buffer.

- An integer underflow in the memcpy size argument when offs
returned by ieee80211_ie_split() exceeds ies_len, causing
unsigned subtraction to wrap to SIZE_MAX and triggering a
fortify panic.

Fix this by validating the IE buffer in cfg80211_wext_siwgenie()
before storing it.

[drop unnecessary ie_len check, update commit message]

Published: 2026-09-24

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A malformed IE buffer can be stored via the cfg80211_wext_siwgenie() ioctl without any validation. When a subsequent network configuration attempts to read these IEs, the kernel performs an out‑of‑bounds read and an integer underflow in a memcpy size argument, which triggers a kernel panic. This results in a denial of service caused by a kernel crash. The weakness is an unchecked input buffer leading to out‑of‑bounds read and integer underflow.

Affected Systems

The vulnerability is present in the Linux kernel. All releases prior to the patch that adds validation in cfg80211_wext_siwgenie() may be affected; specific version details are not included in the advisory.

Risk and Exploitability

Exploitation requires sending malformed IEs via SIOCSIWGENIE, which typically needs CAP_NET_ADMIN, limiting the attack to local privileged users or processes. The kernel crash provides a high impact denial of service. No EPSS score or KEV status is reported, and a CVSS score is not supplied, but the kernel panic indicates significant risk for affected systems.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`f21293549f60f88c74fcb9944737f11048896dc4`	affected	< 269498ce6c1e2132b072aa0c8660404926008f03
`f21293549f60f88c74fcb9944737f11048896dc4`	affected	< 685082f4be77f4657b498ebbe9f942ef65c492cf
`f21293549f60f88c74fcb9944737f11048896dc4`	affected	< 8b921a8993469a3482e0c67b5ce5cb6ce93f5f61
`f21293549f60f88c74fcb9944737f11048896dc4`	affected	< d01f1600e8b075aa17adb751ac9881bb6ee40dcc
`f21293549f60f88c74fcb9944737f11048896dc4`	affected	< c970879e03b23a27df42caf7ba506485a165fb96
`f21293549f60f88c74fcb9944737f11048896dc4`	affected	< 01cc395cecfaa73134d39fb9a401d9605d8bb2c5
`f21293549f60f88c74fcb9944737f11048896dc4`	affected	< a2f5286ca4f304d3fd469f01b96b518608912a5c

Linux

affected

Version	Status	Constraints
`2.6.32`	affected	—
`0`	unaffected	< 2.6.32
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.111`	unaffected	≤ 6.12.*
`6.18.53`	unaffected	≤ 6.18.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,c970879e03b23a27df42caf7ba506485a165fb96)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,01cc395cecfaa73134d39fb9a401d9605d8bb2c5)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,a2f5286ca4f304d3fd469f01b96b518608912a5c)`	affected	code_commit	—
`[0,6.12.111)`	affected	semver	—
`[0,6.18.53)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[6.12.111,6.12.*]`	unaffected	generic	—
`[6.18.53,6.18.*]`	unaffected	generic	—
`[7.2, *]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest kernel update that includes the fix for cfg80211_wext_siwgenie() IE validation.
Restrict access to Wi‑Fi ioctl operations by limiting CAP_NET_ADMIN privileges or configuring udev rules to bound device access to trusted users.
Monitor kernel logs for messages related to cfg80211_wext_siwgenie() or incorrect IE inputs to detect ongoing exploitation attempts.

Generated by OpenCVE AI on September 25, 2026 at 07:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DLA	DLA-4841-1	linux security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00173.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/01cc395cecfaa73134d39fb9a401d9605d8bb2c5
https://git.kernel.org/stable/c/269498ce6c1e2132b072aa0c8660404926008f03
https://git.kernel.org/stable/c/685082f4be77f4657b498ebbe9f942ef65c492cf
https://git.kernel.org/stable/c/8b921a8993469a3482e0c67b5ce5cb6ce93f5f61
https://git.kernel.org/stable/c/a2f5286ca4f304d3fd469f01b96b518608912a5c
https://git.kernel.org/stable/c/c970879e03b23a27df42caf7ba506485a165fb96
https://git.kernel.org/stable/c/d01f1600e8b075aa17adb751ac9881bb6ee40dcc

History

Sat, 03 Oct 2026 11:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/269498ce6c1e2132b072aa0c8660404926008f03 https://git.kernel.org/stable/c/685082f4be77f4657b498ebbe9f942ef65c492cf https://git.kernel.org/stable/c/8b921a8993469a3482e0c67b5ce5cb6ce93f5f61 https://git.kernel.org/stable/c/d01f1600e8b075aa17adb751ac9881bb6ee40dcc

Fri, 25 Sep 2026 07:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-191 CWE-788

Thu, 24 Sep 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() The KASAN allocation trace shows that a malformed IE buffer is stored via SIOCSIWGENIE (cfg80211_wext_siwgenie()) without any validation. The crash trace shows that a subsequent SIOCSIWESSID triggers a connection attempt which calls cfg80211_sme_get_conn_ies() to process the stored IE buffer, causing: - An out-of-bounds read in skip_ie() which reads ies[pos+1] (the length byte) past the end of the 1-byte buffer. - An integer underflow in the memcpy size argument when offs returned by ieee80211_ie_split() exceeds ies_len, causing unsigned subtraction to wrap to SIZE_MAX and triggering a fortify panic. Fix this by validating the IE buffer in cfg80211_wext_siwgenie() before storing it. [drop unnecessary ie_len check, update commit message]
Title		wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/01cc395cecfaa73134d39fb9a401d9605d8bb2c5 https://git.kernel.org/stable/c/a2f5286ca4f304d3fd469f01b96b518608912a5c https://git.kernel.org/stable/c/c970879e03b23a27df42caf7ba506485a165fb96

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-24T16:02:18.067Z

Updated: 2026-10-03T10:57:19.164Z

Reserved: 2026-09-18T17:59:28.788Z

Link: CVE-2026-93784

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-24T17:17:11.017

Modified: 2026-10-03T11:17:47.927

Link: CVE-2026-93784

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-25T07:30:16Z

Weaknesses

CWE-191
Integer Underflow (Wrap or Wraparound)
CWE-788
Access of Memory Location After End of Buffer

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object