CVE-2026-93803

Received Received - Intake

BaseFortify

Publication date: 2026-09-24

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: fix key index receive bound checks libipw_rx() reads skb->data[hdrlen + 3] to extract the WEP key index in both the software-decrypt key selection path and the hardware-decrypted IV/ICV strip path. In both places the existing guard only checks skb->len >= hdrlen + 3, which proves bytes up to hdrlen + 2 but not the byte at hdrlen + 3. Require hdrlen + 4 bytes before reading that item in both paths. This is a local source-boundary check only; it does not change the key index semantics.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-13

NVD

CVE-2026-93803

EUVD

EUVD-2026-86190

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	b453872c35cfcbdbf5a794737817f7d4e7b1b579
Linux	Linux	b453872c35cfcbdbf5a794737817f7d4e7b1b579
Linux	Linux	b453872c35cfcbdbf5a794737817f7d4e7b1b579
Linux	Linux	b453872c35cfcbdbf5a794737817f7d4e7b1b579
Linux	Linux	b453872c35cfcbdbf5a794737817f7d4e7b1b579
Linux	Linux	b453872c35cfcbdbf5a794737817f7d4e7b1b579
Linux	Linux	b453872c35cfcbdbf5a794737817f7d4e7b1b579
Linux	Linux	2.6.14

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a boundary check issue in the libipw driver. The code reads a WEP key index from network packet data without properly verifying if enough bytes are available. Specifically, it checks for skb->len >= hdrlen + 3 but then reads skb->data[hdrlen + 3], which could be out of bounds.

Detection Guidance

This vulnerability is specific to the Linux kernel's libipw module and requires kernel-level inspection. Detection involves checking kernel logs for related errors or verifying the kernel version against patched releases. Use commands like 'dmesg | grep libipw' or 'uname -r' to check kernel version. If your kernel is older than the patched version, the system may be vulnerable.

Impact Analysis

This flaw could allow an attacker on the same network to cause a denial of service by crashing the system or potentially execute arbitrary code in the kernel context. It affects systems using the libipw driver for WEP encryption.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a local source-boundary issue in the Linux kernel's wifi subsystem that could lead to out-of-bounds reads but does not involve data exposure or privacy violations typically addressed by these regulations.

Mitigation Strategies

Update the Linux kernel to a version that includes the fix for CVE-2026-93803. This typically involves running 'sudo apt update && sudo apt upgrade' on Debian-based systems or 'sudo yum update' on RHEL-based systems. Reboot the system after updating to ensure the new kernel is active.

Hi! I’m here to help you understand CVE-2026-93803. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70