All vulnerabilities
CVE-2026-93799

Linux: wifi: iwlwifi: mvm: validate sta_id in BA window status notif

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
8.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.24%Chance of exploitation activity in the next 30 days, higher than 14% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6aa77efaea9efea92e3090c35ad348fd759a3cf3Fixed versionCVE List
Published24 Sep 2026Updated 3 Oct 2026CVE List

What fixes it

  • 6aa77efaea9efea92e3090c35ad348fd759a3cf3LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: validate sta_id in BA window status notif

BA_WINDOW_STATUS_NOTIFICATION_ID extracts a 5-bit sta_id from the firmware notification and uses it to index fw_id_to_mac_id[] without bounds checking. Validate sta_id before array access to prevent out-of-bounds indexing.

Text from CVE List

Affected versions 10

  • Linuxaffected: 3af512d6aac7eb6420086f124abb4426f5f4b369 before f9938eb95e2ddab4a58d3946a320abcbd60b56a4CVE List
  • Linuxaffected: 3af512d6aac7eb6420086f124abb4426f5f4b369 before bb08fbbbd5568d33069485ecb0a1657f115a4e9fCVE List
  • Linuxaffected: 3af512d6aac7eb6420086f124abb4426f5f4b369 before e35ae757c6462bfd3437bf58121bb721fe1f790cCVE List
  • Linuxaffected: 3af512d6aac7eb6420086f124abb4426f5f4b369 before 6aa77efaea9efea92e3090c35ad348fd759a3cf3CVE List
  • Linuxaffected: 4.6CVE List
  • Linuxunaffected: all versions before 4.6CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2CVE List

References 4