Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-93803

wifi: libipw: fix key index receive bound checks

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: fix key index receive bound checks libipw_rx() reads skb->data[hdrlen + 3] to extract the WEP key index in both the software-decrypt key selection path and the hardware-decrypted IV/ICV strip path. In both places the existing guard only checks skb->len >= hdrlen + 3, which proves bytes up to hdrlen + 2 but not the byte at hdrlen + 3. Require hdrlen + 4 bytes before reading that item in both paths. This is a local source-boundary check only; it does not change the key index semantics.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • b453872c35cfcbdbf5a794737817f7d4e7b1b579 to < bb18262c19feb690ddde58c70e3ad04bc6fe566eaffected
  • b453872c35cfcbdbf5a794737817f7d4e7b1b579 to < 09d4a1bc3a08bb0e19bdf250b9f575cfef0bae82affected
  • b453872c35cfcbdbf5a794737817f7d4e7b1b579 to < 2836a870f612a8a6d9e390d00fa2cf6c90aa5808affected
  • b453872c35cfcbdbf5a794737817f7d4e7b1b579 to < 0b61c465ea62063593bc9ac186871b69e58ae991affected
  • b453872c35cfcbdbf5a794737817f7d4e7b1b579 to < 062840bdc9ee06169b3c371bf66711f1d7ec0bf4affected
  • b453872c35cfcbdbf5a794737817f7d4e7b1b579 to < c54b643e9a0936d038921c547736574fd7382ceaaffected
  • b453872c35cfcbdbf5a794737817f7d4e7b1b579 to < 74ed3669f26803b1761c1f55403062bea44c3466affected

Linux Linux

Default version status: affected

  • 2.6.14affected
  • 0 to < 2.6.14unaffected
  • 5.10.271 to ≤ 5.10.*unaffected
  • 5.15.222 to ≤ 5.15.*unaffected
  • 6.1.189 to ≤ 6.1.*unaffected
  • 6.6.158 to ≤ 6.6.*unaffected
  • 6.12.111 to ≤ 6.12.*unaffected
  • 6.18.53 to ≤ 6.18.*unaffected
  • 7.2 to ≤ *unaffected

References