All vulnerabilities
CVE-2026-93790

Linux: wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
8.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.24%Chance of exploitation activity in the next 30 days, higher than 14% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in35f991d685feafd27255bd33272512c434e52527Also 94d3982806c7f194b23484befde12934dda23064CVE List
Published24 Sep 2026Updated 3 Oct 2026CVE List

What fixes it

  • 35f991d685feafd27255bd33272512c434e52527LinuxCVE List
  • 94d3982806c7f194b23484befde12934dda23064LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif

mvmsta->tid_data was indexed by the TFD loop counter 'i' instead of the actual TID value 'tid'. This writes lq_color into a random tid_data slot unrelated to the BA entry. Since multi-TID blockack is not really in use, 'i' was always 0 and no harm was done. Add a out-of-bound check before accessing the array.

Text from CVE List

Affected versions 10

  • Linuxaffected: 41fd2fec56db2564f02532ed7244e1f69193b4ad before 35f991d685feafd27255bd33272512c434e52527CVE List
  • Linuxaffected: 41fd2fec56db2564f02532ed7244e1f69193b4ad before c48b741277b01b2c3b4ecccedc72fc575b71dc04CVE List
  • Linuxaffected: 41fd2fec56db2564f02532ed7244e1f69193b4ad before e8ac5e91b1296f65c3d119fac3fa917ff458f811CVE List
  • Linuxaffected: 41fd2fec56db2564f02532ed7244e1f69193b4ad before 94d3982806c7f194b23484befde12934dda23064CVE List
  • Linuxaffected: 4.15CVE List
  • Linuxunaffected: all versions before 4.15CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2CVE List

References 4