Vulnerability-Lookup

FKIE_CVE-2026-93806

Vulnerability from fkie_nvd - Published: 2026-09-24 17:17 - Updated: 2026-09-25 05:17

Severity

8.8 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate assoc response length before status and IE access cfg80211_rx_assoc_resp() initialises the status and response-IE fields of cfg80211_connect_resp_params from the management frame before proving that the frame is long enough for those offsets. S1G and regular association responses also have different IE offsets, but the S1G path only patched resp_ie after the unsafe initialiser had already run. Defer resp_ie, resp_ie_len, and status to after the link-iteration loop. Use a bool to remember whether the frame is S1G, then validate the appropriate minimum length and set all three fields in a single if/else block. Funnel short-frame and SME-reject cleanup through a shared free_bss label for the abandon paths.

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/78ac450ad4624d6b2999cb4eeb28916767f81247
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/a57310600c1e2b9ada0f37c96e8f48aef47d3093
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/b760113aeca2e9362d56bf9e9263373ffe6c8eb3

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/mlme.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a57310600c1e2b9ada0f37c96e8f48aef47d3093",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "78ac450ad4624d6b2999cb4eeb28916767f81247",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "b760113aeca2e9362d56bf9e9263373ffe6c8eb3",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "6.12.111",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.53",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/mlme.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: validate assoc response length before status and IE access\n\ncfg80211_rx_assoc_resp() initialises the status and response-IE fields\nof cfg80211_connect_resp_params from the management frame before\nproving that the frame is long enough for those offsets. S1G and\nregular association responses also have different IE offsets, but the\nS1G path only patched resp_ie after the unsafe initialiser had already\nrun.\n\nDefer resp_ie, resp_ie_len, and status to after the link-iteration\nloop. Use a bool to remember whether the frame is S1G, then validate\nthe appropriate minimum length and set all three fields in a single\nif/else block. Funnel short-frame and SME-reject cleanup through a\nshared free_bss label for the abandon paths."
    }
  ],
  "id": "CVE-2026-93806",
  "lastModified": "2026-09-25T05:17:03.423",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-24T17:17:13.570",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/78ac450ad4624d6b2999cb4eeb28916767f81247"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/a57310600c1e2b9ada0f37c96e8f48aef47d3093"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/b760113aeca2e9362d56bf9e9263373ffe6c8eb3"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

CVE-2026-93806 (GCVE-0-2026-93806)

Vulnerability from cvelistv5 – Published: 2026-09-24 16:02 – Updated: 2026-09-25 05:10

Title

wifi: cfg80211: validate assoc response length before status and IE access

Summary

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/a57310600c1e2b9ad…
https://git.kernel.org/stable/c/78ac450ad4624d6b2…
https://git.kernel.org/stable/c/b760113aeca2e9362…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < a57310600c1e2b9ada0f37c96e8f48aef47d3093 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 78ac450ad4624d6b2999cb4eeb28916767f81247 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < b760113aeca2e9362d56bf9e9263373ffe6c8eb3 (git) Affected: 0 , < 6.12.111 (semver) Affected: 0 , < 6.18.53 (semver)
Linux	Linux	Unaffected: 6.12.111 , ≤ 6.12.* (semver) Unaffected: 6.18.53 , ≤ 6.18.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/mlme.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a57310600c1e2b9ada0f37c96e8f48aef47d3093",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "78ac450ad4624d6b2999cb4eeb28916767f81247",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "b760113aeca2e9362d56bf9e9263373ffe6c8eb3",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "6.12.111",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.53",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/wireless/mlme.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: validate assoc response length before status and IE access\n\ncfg80211_rx_assoc_resp() initialises the status and response-IE fields\nof cfg80211_connect_resp_params from the management frame before\nproving that the frame is long enough for those offsets. S1G and\nregular association responses also have different IE offsets, but the\nS1G path only patched resp_ie after the unsafe initialiser had already\nrun.\n\nDefer resp_ie, resp_ie_len, and status to after the link-iteration\nloop. Use a bool to remember whether the frame is S1G, then validate\nthe appropriate minimum length and set all three fields in a single\nif/else block. Funnel short-frame and SME-reject cleanup through a\nshared free_bss label for the abandon paths."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The malformed input is an 802.11 (Re)Association Response in data-\u003ebuf that cfg80211_rx_assoc_resp() parses as ieee80211_mgmt. It is delivered by ieee80211_rx_h_mgmt \u2192 ieee80211_sta_rx_queued_frame \u2192 ieee80211_rx_mgmt_assoc_resp, or by mwifiex_ret_802_11_associate \u2192 mwifiex_process_assoc_resp. Those frames are WiFi radio-range, not a routable IP protocol.\nAC:L - mwifiex_ret_802_11_associate copies resp-\u003eparams of length (resp-\u003esize - S_DS_GEN) into assoc_rsp_buf with no 30-byte floor; mwifiex_process_assoc_resp then calls cfg80211_rx_assoc_resp with that len. A rogue AP\u0027s truncated AssocResp makes data-\u003elen \u003c offsetof(ieee80211_mgmt, u.assoc_resp.variable), so the size_t subtraction for cr.resp_ie_len wraps every time. No race.\nPR:N - cfg80211_rx_assoc_resp runs on the station MLME RX path. ieee80211_rx_mgmt_assoc_resp only requires ifmgd-\u003eassoc_data and matching SA/BSSID; mwifiex_host_mlme_work_queue has no capable() or uid check. The AssocResp is parsed before the 4-way handshake, so a radio attacker needs no host account or PSK.\nUI:N - A saved-network auto-reconnect or evil-twin of a known SSID puts ifmgd-\u003eassoc_data / the mwifiex associate command in flight; the attacker\u0027s AssocResp is then handled in ieee80211_rx_mgmt_assoc_resp or mwifiex_process_assoc_resp with no further victim click.\nS:U - The underflowed cr.resp_ie_len is consumed in nl80211_send_connect_result() \u2192 nla_put(NL80211_ATTR_RESP_IE) / __nla_put() on host-kernel heap (the nlmsg skb and adjacent objects). No VM, IOMMU, or sandbox boundary is crossed.\nC:H - When data-\u003elen \u003c 30, cr.resp_ie_len = data-\u003elen - offsetof(ieee80211_mgmt, u.assoc_resp.variable) wraps. nl80211_send_connect_result() then nla_put(NL80211_ATTR_RESP_IE, that length, cr.resp_ie) and __nla_put memcpy\u0027s from mgmt-\u003eu.assoc_resp.variable, disclosing kernel memory far past the short frame; status_code at offset 26 is also an OOB load.\nI:H - nlmsg_new(100 + cr-\u003eresp_ie_len + ...) in nl80211_send_connect_result wraps the skb allocation small when resp_ie_len underflows. nla_put then passes that length as int into __nla_put, whose memcpy writes past the skb, and __nla_reserve memset\u0027s at the wrapped u16 nla_len \u2014 a kernel heap overflow write.\nA:H - The same __nla_put memcpy of the wrapped cr.resp_ie_len, or __nla_reserve\u0027s memset at the wrapped u16 nla_len, can walk into unmapped or redzone memory and oops/panic. Repeating association retriggers it."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T05:10:15.232Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a57310600c1e2b9ada0f37c96e8f48aef47d3093"
        },
        {
          "url": "https://git.kernel.org/stable/c/78ac450ad4624d6b2999cb4eeb28916767f81247"
        },
        {
          "url": "https://git.kernel.org/stable/c/b760113aeca2e9362d56bf9e9263373ffe6c8eb3"
        }
      ],
      "title": "wifi: cfg80211: validate assoc response length before status and IE access",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-93806",
    "datePublished": "2026-09-24T16:02:40.159Z",
    "dateReserved": "2026-09-18T17:59:28.790Z",
    "dateUpdated": "2026-09-25T05:10:15.232Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

FKIE_CVE-2026-93806

CVE-2026-93806 (GCVE-0-2026-93806)

Tags

Sightings

Nomenclature

Related by attack behaviour