CVE-2026-93805
Received Received - Intake

Buffer Overflow in Linux Kernel cfg80211 Subsystem

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate rx/tx MLME callback frame lengths before access cfg80211_rx_mlme_mgmt() and cfg80211_tx_mlme_mgmt() call tracepoints before rejecting frames shorter than the frame-control field. After that, they only require len >= 2 before dispatching into subtype handlers that assume their fixed fields are present. The frames that trip this are not shorter than 2 bytes; they are short relative to their subtype. mwifiex is a concrete in-tree example on the length side: mwifiex_process_mgmt_packet() only requires a 4-address ieee80211_hdr plus the 2-byte firmware length prefix before handing the frame to cfg80211_rx_mlme_mgmt(). After stripping the length prefix and removing addr4, pkt_len can be exactly 24: a bare 3-address management header with no reason-code body. The existing WARN_ON(len < 2) does not fire on such a frame, and cfg80211_process_deauth() then reads u.deauth.reason_code as a two-byte access starting at offset 24, immediately past the 24-byte buffer. Add a frame-control length gate, then validate each subtype's minimum frame size in an if/else-if chain that mirrors the dispatch logic. Trace only after the frame is known to be well-formed. Side effects of this change: - The WARN_ON(len < 2) is dropped. It only guarded the frame_control read, never the subtype fixed fields, and it does not fire on the frames that actually trigger the out-of-bounds read (which are >= 2). The len >= 2 check is kept as the guard before dereferencing frame_control, but without the warning: these are exported callbacks and a malformed frame from a driver should be dropped silently rather than backtraced. - cfg80211_tx_mlme_mgmt() previously routed every non-deauth subtype through disassociation handling; it now silently ignores unrecognised subtypes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-93805
EUVD
EUVD-2026-86192

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper validation of wireless management frames before accessing their data. The issue occurs in the cfg80211 subsystem where frames shorter than expected for their subtype can trigger out-of-bounds memory reads. Attackers could exploit this to read sensitive kernel memory by sending maliciously crafted Wi-Fi frames.

Detection Guidance

This vulnerability is specific to the Linux kernel's wifi subsystem and requires kernel-level inspection. Detection involves checking kernel logs for out-of-bounds read warnings or examining the cfg80211 module for unusual frame handling. Use commands like 'dmesg | grep -i cfg80211' or 'journalctl -k | grep -i cfg80211' to search for related errors.

Impact Analysis

If exploited, this flaw could allow attackers within Wi-Fi range to crash the system or potentially execute arbitrary code with kernel privileges. This could lead to unauthorized access, data theft, or denial-of-service conditions on affected Linux systems.

Mitigation Strategies
  • Update the Linux kernel to a patched version that includes the fix for CVE-2026-93805.
  • Monitor network interfaces for unusual activity or crashes that may indicate exploitation attempts.
  • Restrict untrusted users or drivers from interacting with wifi hardware to reduce attack surface.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93805. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart