CVE-2026-93806 (GCVE-0-2026-93806)
Vulnerability from cvelistv5
Published
2026-09-24 16:02
Modified
2026-10-03 10:57
Severity ?
8.8 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate assoc response length before status and IE access cfg80211_rx_assoc_resp() initialises the status and response-IE fields of cfg80211_connect_resp_params from the management frame before proving that the frame is long enough for those offsets. S1G and regular association responses also have different IE offsets, but the S1G path only patched resp_ie after the unsafe initialiser had already run. Defer resp_ie, resp_ie_len, and status to after the link-iteration loop. Use a bool to remember whether the frame is S1G, then validate the appropriate minimum length and set all three fields in a single if/else block. Funnel short-frame and SME-reject cleanup through a shared free_bss label for the abandon paths.
References
Impacted products
Vendor Product Version
Linux Linux Version: 6829c878ecd24ff0ae41b4668c7e9d0f11b66942
Version: 6829c878ecd24ff0ae41b4668c7e9d0f11b66942
Version: 6829c878ecd24ff0ae41b4668c7e9d0f11b66942
Version: 6829c878ecd24ff0ae41b4668c7e9d0f11b66942
Version: 6829c878ecd24ff0ae41b4668c7e9d0f11b66942
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/mlme.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3bcaaaa4ad334053ceea2ea2f0623f22afe2e1ac",
              "status": "affected",
              "version": "6829c878ecd24ff0ae41b4668c7e9d0f11b66942",
              "versionType": "git"
            },
            {
              "lessThan": "71be658246c903b9e96976a23c23800675896a1b",
              "status": "affected",
              "version": "6829c878ecd24ff0ae41b4668c7e9d0f11b66942",
              "versionType": "git"
            },
            {
              "lessThan": "a57310600c1e2b9ada0f37c96e8f48aef47d3093",
              "status": "affected",
              "version": "6829c878ecd24ff0ae41b4668c7e9d0f11b66942",
              "versionType": "git"
            },
            {
              "lessThan": "78ac450ad4624d6b2999cb4eeb28916767f81247",
              "status": "affected",
              "version": "6829c878ecd24ff0ae41b4668c7e9d0f11b66942",
              "versionType": "git"
            },
            {
              "lessThan": "b760113aeca2e9362d56bf9e9263373ffe6c8eb3",
              "status": "affected",
              "version": "6829c878ecd24ff0ae41b4668c7e9d0f11b66942",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/mlme.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.32"
            },
            {
              "lessThan": "2.6.32",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: validate assoc response length before status and IE access\n\ncfg80211_rx_assoc_resp() initialises the status and response-IE fields\nof cfg80211_connect_resp_params from the management frame before\nproving that the frame is long enough for those offsets. S1G and\nregular association responses also have different IE offsets, but the\nS1G path only patched resp_ie after the unsafe initialiser had already\nrun.\n\nDefer resp_ie, resp_ie_len, and status to after the link-iteration\nloop. Use a bool to remember whether the frame is S1G, then validate\nthe appropriate minimum length and set all three fields in a single\nif/else block. Funnel short-frame and SME-reject cleanup through a\nshared free_bss label for the abandon paths."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The malformed input is an 802.11 (Re)Association Response in data-\u003ebuf that cfg80211_rx_assoc_resp() parses as ieee80211_mgmt. It is delivered by ieee80211_rx_h_mgmt \u2192 ieee80211_sta_rx_queued_frame \u2192 ieee80211_rx_mgmt_assoc_resp, or by mwifiex_ret_802_11_associate \u2192 mwifiex_process_assoc_resp. Those frames are WiFi radio-range, not a routable IP protocol.\nAC:L - mwifiex_ret_802_11_associate copies resp-\u003eparams of length (resp-\u003esize - S_DS_GEN) into assoc_rsp_buf with no 30-byte floor; mwifiex_process_assoc_resp then calls cfg80211_rx_assoc_resp with that len. A rogue AP\u0027s truncated AssocResp makes data-\u003elen \u003c offsetof(ieee80211_mgmt, u.assoc_resp.variable), so the size_t subtraction for cr.resp_ie_len wraps every time. No race.\nPR:N - cfg80211_rx_assoc_resp runs on the station MLME RX path. ieee80211_rx_mgmt_assoc_resp only requires ifmgd-\u003eassoc_data and matching SA/BSSID; mwifiex_host_mlme_work_queue has no capable() or uid check. The AssocResp is parsed before the 4-way handshake, so a radio attacker needs no host account or PSK.\nUI:N - A saved-network auto-reconnect or evil-twin of a known SSID puts ifmgd-\u003eassoc_data / the mwifiex associate command in flight; the attacker\u0027s AssocResp is then handled in ieee80211_rx_mgmt_assoc_resp or mwifiex_process_assoc_resp with no further victim click.\nS:U - The underflowed cr.resp_ie_len is consumed in nl80211_send_connect_result() \u2192 nla_put(NL80211_ATTR_RESP_IE) / __nla_put() on host-kernel heap (the nlmsg skb and adjacent objects). No VM, IOMMU, or sandbox boundary is crossed.\nC:H - When data-\u003elen \u003c 30, cr.resp_ie_len = data-\u003elen - offsetof(ieee80211_mgmt, u.assoc_resp.variable) wraps. nl80211_send_connect_result() then nla_put(NL80211_ATTR_RESP_IE, that length, cr.resp_ie) and __nla_put memcpy\u0027s from mgmt-\u003eu.assoc_resp.variable, disclosing kernel memory far past the short frame; status_code at offset 26 is also an OOB load.\nI:H - nlmsg_new(100 + cr-\u003eresp_ie_len + ...) in nl80211_send_connect_result wraps the skb allocation small when resp_ie_len underflows. nla_put then passes that length as int into __nla_put, whose memcpy writes past the skb, and __nla_reserve memset\u0027s at the wrapped u16 nla_len \u2014 a kernel heap overflow write.\nA:H - The same __nla_put memcpy of the wrapped cr.resp_ie_len, or __nla_reserve\u0027s memset at the wrapped u16 nla_len, can walk into unmapped or redzone memory and oops/panic. Repeating association retriggers it."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-03T10:57:39.214Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3bcaaaa4ad334053ceea2ea2f0623f22afe2e1ac"
        },
        {
          "url": "https://git.kernel.org/stable/c/71be658246c903b9e96976a23c23800675896a1b"
        },
        {
          "url": "https://git.kernel.org/stable/c/a57310600c1e2b9ada0f37c96e8f48aef47d3093"
        },
        {
          "url": "https://git.kernel.org/stable/c/78ac450ad4624d6b2999cb4eeb28916767f81247"
        },
        {
          "url": "https://git.kernel.org/stable/c/b760113aeca2e9362d56bf9e9263373ffe6c8eb3"
        }
      ],
      "title": "wifi: cfg80211: validate assoc response length before status and IE access",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-93806",
    "datePublished": "2026-09-24T16:02:40.159Z",
    "dateReserved": "2026-09-18T17:59:28.790Z",
    "dateUpdated": "2026-10-03T10:57:39.214Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.