All vulnerabilities
CVE-2026-93802

Linux: wifi: rsi: validate beacon length before fixed buffer copy

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in795ba65f46fe44061f1195951c122cc8ec685d44Also 66a964432b2758a4cf69962366e37581d6e70632, 7f99742c3c2801f8033d8b7a0a58254d7f24fb1e and 3 moreCVE List
Published24 Sep 2026Updated 3 Oct 2026CVE List

What fixes it

  • 795ba65f46fe44061f1195951c122cc8ec685d44LinuxCVE List
  • 66a964432b2758a4cf69962366e37581d6e70632LinuxCVE List
  • 7f99742c3c2801f8033d8b7a0a58254d7f24fb1eLinuxCVE List
  • 87710ad633ce4588aec88611d0d0745eb33a6991LinuxCVE List
  • 266f195d5a14eec6c482fd09fbc924584c3371a7LinuxCVE List
  • 8ecdeb8b8a33b22c597299043c0dcfce50beb9eaLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: rsi: validate beacon length before fixed buffer copy

rsi_prepare_beacon() copies the mac80211 beacon frame after FRAME_DESC_SZ into a management skb whose usable tailroom may be smaller than MAX_MGMT_PKT_SIZE after alignment.

Validate the beacon length against the actual tailroom before the copy and skb_put(). Leave ownership of the management skb with the caller on error, matching the existing rsi_send_beacon() cleanup path.

Text from CVE List

Affected versions 16

  • Linuxaffected: d26a9559403c7c3ec3b430f5825bc22c3d40abdb before 795ba65f46fe44061f1195951c122cc8ec685d44CVE List
  • Linuxaffected: d26a9559403c7c3ec3b430f5825bc22c3d40abdb before 66a964432b2758a4cf69962366e37581d6e70632CVE List
  • Linuxaffected: d26a9559403c7c3ec3b430f5825bc22c3d40abdb before 7f99742c3c2801f8033d8b7a0a58254d7f24fb1eCVE List
  • Linuxaffected: d26a9559403c7c3ec3b430f5825bc22c3d40abdb before f08d7f3c916335a0e539f1c45c130615967fac47CVE List
  • Linuxaffected: d26a9559403c7c3ec3b430f5825bc22c3d40abdb before 87710ad633ce4588aec88611d0d0745eb33a6991CVE List
  • Linuxaffected: d26a9559403c7c3ec3b430f5825bc22c3d40abdb before 266f195d5a14eec6c482fd09fbc924584c3371a7CVE List
  • Linuxaffected: d26a9559403c7c3ec3b430f5825bc22c3d40abdb before 8ecdeb8b8a33b22c597299043c0dcfce50beb9eaCVE List
  • Linuxaffected: 4.14CVE List
  • Linuxunaffected: all versions before 4.14CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2CVE List

References 7