All vulnerabilities
CVE-2026-93803

Linux: wifi: libipw: fix key index receive bound checks

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in09d4a1bc3a08bb0e19bdf250b9f575cfef0bae82Also 2836a870f612a8a6d9e390d00fa2cf6c90aa5808, 0b61c465ea62063593bc9ac186871b69e58ae991 and 2 moreCVE List
Published24 Sep 2026Updated 3 Oct 2026CVE List

What fixes it

  • 09d4a1bc3a08bb0e19bdf250b9f575cfef0bae82LinuxCVE List
  • 2836a870f612a8a6d9e390d00fa2cf6c90aa5808LinuxCVE List
  • 0b61c465ea62063593bc9ac186871b69e58ae991LinuxCVE List
  • 062840bdc9ee06169b3c371bf66711f1d7ec0bf4LinuxCVE List
  • 74ed3669f26803b1761c1f55403062bea44c3466LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: libipw: fix key index receive bound checks

libipw_rx() reads skb->data[hdrlen + 3] to extract the WEP key index in both the software-decrypt key selection path and the hardware-decrypted IV/ICV strip path. In both places the existing guard only checks skb->len >= hdrlen + 3, which proves bytes up to hdrlen + 2 but not the byte at hdrlen + 3.

Require hdrlen + 4 bytes before reading that item in both paths. This is a local source-boundary check only; it does not change the key index semantics.

Text from CVE List

Affected versions 16

  • Linuxaffected: b453872c35cfcbdbf5a794737817f7d4e7b1b579 before bb18262c19feb690ddde58c70e3ad04bc6fe566eCVE List
  • Linuxaffected: b453872c35cfcbdbf5a794737817f7d4e7b1b579 before 09d4a1bc3a08bb0e19bdf250b9f575cfef0bae82CVE List
  • Linuxaffected: b453872c35cfcbdbf5a794737817f7d4e7b1b579 before 2836a870f612a8a6d9e390d00fa2cf6c90aa5808CVE List
  • Linuxaffected: b453872c35cfcbdbf5a794737817f7d4e7b1b579 before 0b61c465ea62063593bc9ac186871b69e58ae991CVE List
  • Linuxaffected: b453872c35cfcbdbf5a794737817f7d4e7b1b579 before 062840bdc9ee06169b3c371bf66711f1d7ec0bf4CVE List
  • Linuxaffected: b453872c35cfcbdbf5a794737817f7d4e7b1b579 before c54b643e9a0936d038921c547736574fd7382ceaCVE List
  • Linuxaffected: b453872c35cfcbdbf5a794737817f7d4e7b1b579 before 74ed3669f26803b1761c1f55403062bea44c3466CVE List
  • Linuxaffected: 2.6.14CVE List
  • Linuxunaffected: all versions before 2.6.14CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2CVE List

References 7