FKIE_CVE-2026-93281

Vulnerability from fkie_nvd - Published: 2026-09-24 16:17 - Updated: 2026-09-24 16:17
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix HE extended capability length check rtw89_mac_check_he_obss_narrow_bw_ru_iter() reads extended capability byte 10, but rejects only datalen values below 10. Byte 10 requires at least 11 bytes. Require datalen >= 11 before reading data[10].
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2aba608a86e9b099c9af2ea70b620552dee2b628
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/655c4401c18d735dbaf2cc172ff4f626b3a896a0
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/bddbd1de765bf6ddc0473ad683910eb3a2a92a43
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/eddf53f1edb0cf7f302bd15cdb47cca90948c205
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f132fc01b359a0f7d81fe13d769ea4e7c4baa66e
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f2a01deff7d0d5cc3dcbf2358dac113979303c8e
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/realtek/rtw89/mac.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "eddf53f1edb0cf7f302bd15cdb47cca90948c205",
              "status": "affected",
              "version": "8d540f9d29162e273797bef36686a010724f0f8a",
              "versionType": "git"
            },
            {
              "lessThan": "655c4401c18d735dbaf2cc172ff4f626b3a896a0",
              "status": "affected",
              "version": "8d540f9d29162e273797bef36686a010724f0f8a",
              "versionType": "git"
            },
            {
              "lessThan": "bddbd1de765bf6ddc0473ad683910eb3a2a92a43",
              "status": "affected",
              "version": "8d540f9d29162e273797bef36686a010724f0f8a",
              "versionType": "git"
            },
            {
              "lessThan": "f2a01deff7d0d5cc3dcbf2358dac113979303c8e",
              "status": "affected",
              "version": "8d540f9d29162e273797bef36686a010724f0f8a",
              "versionType": "git"
            },
            {
              "lessThan": "f132fc01b359a0f7d81fe13d769ea4e7c4baa66e",
              "status": "affected",
              "version": "8d540f9d29162e273797bef36686a010724f0f8a",
              "versionType": "git"
            },
            {
              "lessThan": "2aba608a86e9b099c9af2ea70b620552dee2b628",
              "status": "affected",
              "version": "8d540f9d29162e273797bef36686a010724f0f8a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/wireless/realtek/rtw89/mac.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "lessThan": "6.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: fix HE extended capability length check\n\nrtw89_mac_check_he_obss_narrow_bw_ru_iter() reads extended capability\nbyte 10, but rejects only datalen values below 10.  Byte 10 requires at\nleast 11 bytes.\n\nRequire datalen \u003e= 11 before reading data[10]."
    }
  ],
  "id": "CVE-2026-93281",
  "lastModified": "2026-09-24T16:17:25.440",
  "metrics": {},
  "published": "2026-09-24T16:17:25.440",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/2aba608a86e9b099c9af2ea70b620552dee2b628"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/655c4401c18d735dbaf2cc172ff4f626b3a896a0"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/bddbd1de765bf6ddc0473ad683910eb3a2a92a43"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/eddf53f1edb0cf7f302bd15cdb47cca90948c205"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/f132fc01b359a0f7d81fe13d769ea4e7c4baa66e"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/f2a01deff7d0d5cc3dcbf2358dac113979303c8e"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.