CVE-2026-93789
Received Received - Intake

WiFi Firmware TLV Length Validation Flaw

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: bound aligned TLV advance in FW parser Validate ALIGN(tlv_len, 4) against remaining parser length before consuming bytes from the firmware image. This avoids length underflow on malformed TLVs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-93789
EUVD
EUVD-2026-86176

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the iwlwifi driver's firmware parser. It occurs when processing aligned Type-Length-Value (TLV) structures, where the parser does not validate the length against the remaining data before consuming bytes. This can lead to a length underflow if the TLV is malformed, potentially causing undefined behavior or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's iwlwifi driver and relates to firmware parsing. Detection requires checking kernel logs for firmware-related errors or crashes. Monitor logs with 'dmesg | grep iwlwifi' or 'journalctl -k | grep iwlwifi' for malformed TLV warnings.

Impact Analysis

If exploited, this vulnerability could allow an attacker to cause a denial-of-service (DoS) condition by crashing the system or triggering undefined behavior in the kernel. It may also enable further exploitation if combined with other vulnerabilities, though it requires a malformed firmware image to be processed.

Mitigation Strategies

Update your Linux kernel to the latest stable version where this issue is resolved. If using a distribution kernel, apply vendor patches immediately. Avoid using custom or outdated iwlwifi firmware versions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93789. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart