All vulnerabilities
CVE-2026-93791

Linux: wifi: iwlwifi: mvm: add a check on the tid coming from the firmware

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0f690fd3b5535d110898b99ae6214f29c9060941Also 0b5325a0771674f1d65618de7db3df9d49186a12, 59f64c2839022f41a7867b38f9e38c185ff39283 and 1 moreCVE List
Published24 Sep 2026Updated 3 Oct 2026CVE List

What fixes it

  • 0f690fd3b5535d110898b99ae6214f29c9060941LinuxCVE List
  • 0b5325a0771674f1d65618de7db3df9d49186a12LinuxCVE List
  • 59f64c2839022f41a7867b38f9e38c185ff39283LinuxCVE List
  • 0e4c0d83267261cf67ec9690856edf4a56bb7dfcLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: add a check on the tid coming from the firmware

ba_notif->tid is a firmware-controlled u8 that is used directly as an array index into tid_data[] without any validation. Add a bounds check against IWL_MAX_TID_COUNT before dereferencing the array.

Text from CVE List

Affected versions 10

  • Linuxaffected: c46e7724bfe9bbff17bc468903a757248b99e4ed before 0f690fd3b5535d110898b99ae6214f29c9060941CVE List
  • Linuxaffected: c46e7724bfe9bbff17bc468903a757248b99e4ed before 0b5325a0771674f1d65618de7db3df9d49186a12CVE List
  • Linuxaffected: c46e7724bfe9bbff17bc468903a757248b99e4ed before 59f64c2839022f41a7867b38f9e38c185ff39283CVE List
  • Linuxaffected: c46e7724bfe9bbff17bc468903a757248b99e4ed before 0e4c0d83267261cf67ec9690856edf4a56bb7dfcCVE List
  • Linuxaffected: 4.9CVE List
  • Linuxunaffected: all versions before 4.9CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2CVE List

References 4