CVE-2026-93805 - Vulnerability Details

- wifi: cfg80211: validate rx/tx MLME callback frame lengths before access

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: validate rx/tx MLME callback frame lengths before access

cfg80211_rx_mlme_mgmt() and cfg80211_tx_mlme_mgmt() call tracepoints
before rejecting frames shorter than the frame-control field. After
that, they only require len >= 2 before dispatching into subtype
handlers that assume their fixed fields are present.

The frames that trip this are not shorter than 2 bytes; they are short
relative to their subtype. mwifiex is a concrete in-tree example on the
length side: mwifiex_process_mgmt_packet() only requires a 4-address
ieee80211_hdr plus the 2-byte firmware length prefix before handing the
frame to cfg80211_rx_mlme_mgmt(). After stripping the length prefix and
removing addr4, pkt_len can be exactly 24: a bare 3-address management
header with no reason-code body. The existing WARN_ON(len < 2) does not
fire on such a frame, and cfg80211_process_deauth() then reads
u.deauth.reason_code as a two-byte access starting at offset 24,
immediately past the 24-byte buffer.

Add a frame-control length gate, then validate each subtype's minimum
frame size in an if/else-if chain that mirrors the dispatch logic. Trace
only after the frame is known to be well-formed.

Side effects of this change:
- The WARN_ON(len < 2) is dropped. It only guarded the frame_control
read, never the subtype fixed fields, and it does not fire on the
frames that actually trigger the out-of-bounds read (which are >= 2).
The len >= 2 check is kept as the guard before dereferencing
frame_control, but without the warning: these are exported callbacks
and a malformed frame from a driver should be dropped silently rather
than backtraced.
- cfg80211_tx_mlme_mgmt() previously routed every non-deauth subtype
through disassociation handling; it now silently ignores unrecognised
subtypes.

Published: 2026-09-24

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw in Linux’s cfg80211 subsystem allows a malformed 802.11 management frame to be processed without proper length validation. When a driver such as mwifiex hands a frame that is shorter than the expected subtype header, the kernel attempts to read fields beyond the end of the buffer, causing an out‑of‑bounds read that can trigger a crash or memory corruption. The vulnerability is limited to the kernel code that handles receive and transmit MLME callbacks and does not involve user‑land code directly.

Affected Systems

All Linux kernel releases before the patch that adds length gating to cfg80211_rx_mlme_mgmt and cfg80211_tx_mlme_mgmt are affected. The issue is exercised by drivers that forward raw management frames, such as mwifiex, so any host running a kernel with the affected driver and an active wireless interface is at risk.

Risk and Exploitability

The flaw has no publicly disclosed exploitation code and is not listed in the CISA KEV catalog. The CVSS score of 5.5 indicates moderate severity, and the EPSS score of < 1% suggests a low yet nonzero likelihood of exploitation. An attacker could trigger the out‑of‑bounds read by broadcasting a specially crafted frame, potentially causing a kernel crash or memory corruption that would result in a denial of service.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`6829c878ecd24ff0ae41b4668c7e9d0f11b66942`	affected	< 6eb4bd50be53f5afbabb3a3b5153276e08fa7a4a
`6829c878ecd24ff0ae41b4668c7e9d0f11b66942`	affected	< ce2a3be6909462f49c34de96be71f0ad5f0d573f
`6829c878ecd24ff0ae41b4668c7e9d0f11b66942`	affected	< 6bdf4dcff98df634e04ebf99f52027a48d7f78ff
`6829c878ecd24ff0ae41b4668c7e9d0f11b66942`	affected	< 0ec738a0d361d7eb37188117166d201f9df622d3
`6829c878ecd24ff0ae41b4668c7e9d0f11b66942`	affected	< 8f4127a93cf60d561ad39849a9ac763ba0e14db5
`6829c878ecd24ff0ae41b4668c7e9d0f11b66942`	affected	< d5e4586546974179feca305a94e07fac3e9727fe

Linux

affected

Version	Status	Constraints
`2.6.32`	affected	—
`0`	unaffected	< 2.6.32
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.111`	unaffected	≤ 6.12.*
`6.18.53`	unaffected	≤ 6.18.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,0ec738a0d361d7eb37188117166d201f9df622d3)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,8f4127a93cf60d561ad39849a9ac763ba0e14db5)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,d5e4586546974179feca305a94e07fac3e9727fe)`	affected	code_commit	—
`[0,6.12.111)`	affected	semver	—
`[0,6.18.53)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[6.12.111,6.13.0)`	unaffected	semver	—
`[6.18.53,6.19.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a kernel update that incorporates the cfg80211 length validation patch (e.g., commit 0ec738a0d361d7eb37188117166d201f9df622d3).
If an update is not immediately possible, disable the wireless interface or unload the offending driver (such as mwifiex) to prevent processing of malformed management frames.
Manually apply the commit from the kernel source to a local build and rebuild the kernel to address the vulnerability.

Generated by OpenCVE AI on October 1, 2026 at 16:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00173.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93805.mbox
https://git.kernel.org/stable/c/0ec738a0d361d7eb37188117166d201f9df622d3
https://git.kernel.org/stable/c/6bdf4dcff98df634e04ebf99f52027a48d7f78ff
https://git.kernel.org/stable/c/6eb4bd50be53f5afbabb3a3b5153276e08fa7a4a
https://git.kernel.org/stable/c/8f4127a93cf60d561ad39849a9ac763ba0e14db5
https://git.kernel.org/stable/c/ce2a3be6909462f49c34de96be71f0ad5f0d573f
https://git.kernel.org/stable/c/d5e4586546974179feca305a94e07fac3e9727fe
https://nvd.nist.gov/vuln/detail/CVE-2026-93805
https://www.cve.org/CVERecord?id=CVE-2026-93805

History

Sat, 03 Oct 2026 11:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/6bdf4dcff98df634e04ebf99f52027a48d7f78ff https://git.kernel.org/stable/c/6eb4bd50be53f5afbabb3a3b5153276e08fa7a4a https://git.kernel.org/stable/c/ce2a3be6909462f49c34de96be71f0ad5f0d573f

Tue, 29 Sep 2026 13:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93805.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-93805 https://www.cve.org/CVERecord?id=CVE-2026-93805
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 25 Sep 2026 07:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125

Thu, 24 Sep 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate rx/tx MLME callback frame lengths before access cfg80211_rx_mlme_mgmt() and cfg80211_tx_mlme_mgmt() call tracepoints before rejecting frames shorter than the frame-control field. After that, they only require len >= 2 before dispatching into subtype handlers that assume their fixed fields are present. The frames that trip this are not shorter than 2 bytes; they are short relative to their subtype. mwifiex is a concrete in-tree example on the length side: mwifiex_process_mgmt_packet() only requires a 4-address ieee80211_hdr plus the 2-byte firmware length prefix before handing the frame to cfg80211_rx_mlme_mgmt(). After stripping the length prefix and removing addr4, pkt_len can be exactly 24: a bare 3-address management header with no reason-code body. The existing WARN_ON(len < 2) does not fire on such a frame, and cfg80211_process_deauth() then reads u.deauth.reason_code as a two-byte access starting at offset 24, immediately past the 24-byte buffer. Add a frame-control length gate, then validate each subtype's minimum frame size in an if/else-if chain that mirrors the dispatch logic. Trace only after the frame is known to be well-formed. Side effects of this change: - The WARN_ON(len < 2) is dropped. It only guarded the frame_control read, never the subtype fixed fields, and it does not fire on the frames that actually trigger the out-of-bounds read (which are >= 2). The len >= 2 check is kept as the guard before dereferencing frame_control, but without the warning: these are exported callbacks and a malformed frame from a driver should be dropped silently rather than backtraced. - cfg80211_tx_mlme_mgmt() previously routed every non-deauth subtype through disassociation handling; it now silently ignores unrecognised subtypes.
Title		wifi: cfg80211: validate rx/tx MLME callback frame lengths before access
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0ec738a0d361d7eb37188117166d201f9df622d3 https://git.kernel.org/stable/c/8f4127a93cf60d561ad39849a9ac763ba0e14db5 https://git.kernel.org/stable/c/d5e4586546974179feca305a94e07fac3e9727fe

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-24T16:02:39.248Z

Updated: 2026-10-03T10:57:38.089Z

Reserved: 2026-09-18T17:59:28.790Z

Link: CVE-2026-93805

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-24T17:17:13.460

Modified: 2026-10-03T11:17:50.190

Link: CVE-2026-93805

Redhat

Severity : Moderate

Publid Date: 2026-09-24T00:00:00Z

Links: CVE-2026-93805 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-01T16:45:09Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object