CVE-2026-98193

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject TKIP frames without a full MIC libipw_michael_mic_verify() assumes that an skb contains an eight-byte Michael MIC. A short TKIP frame makes the unsigned payload length wrap, causing michael_mic() to read past the skb. Check that the MIC is present before verifying it, and use the existing MICHAEL_MIC_LEN constant for all MIC lengths in the verifier.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98193

EUVD

EUVD-2026-93121

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	b453872c35cfcbdbf5a794737817f7d4e7b1b579
Linux	Linux	b453872c35cfcbdbf5a794737817f7d4e7b1b579
Linux	Linux	b453872c35cfcbdbf5a794737817f7d4e7b1b579
Linux	Linux	b453872c35cfcbdbf5a794737817f7d4e7b1b579
Linux	Linux	2.6.14

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the libipw driver used for wireless networking. It allows short TKIP frames to bypass Michael MIC verification by causing the payload length to wrap around, leading to out-of-bounds memory reads when checking the integrity of the frame.

Detection Guidance

This vulnerability affects the Linux kernel's libipw driver for TKIP encryption in Wi-Fi. Detection requires checking if your system uses vulnerable kernel versions and inspecting Wi-Fi traffic for malformed TKIP frames. Use commands like 'uname -a' to check kernel version and 'iwconfig' to verify Wi-Fi driver usage. Monitor kernel logs for MIC verification errors.

Impact Analysis

An attacker within Wi-Fi range could exploit this to potentially disrupt wireless communications or inject malicious frames into a network. This may lead to unauthorized access or denial of service if the system processes malformed TKIP frames.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level WiFi security flaw in the Linux kernel. Compliance impacts would depend on system-specific implementations and compensating controls rather than this vulnerability itself.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-98193. Disable TKIP encryption if possible and switch to more secure encryption methods like CCMP (AES). Monitor network traffic for unusual TKIP frame patterns.

Hi! I’m here to help you understand CVE-2026-98193. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70