CVE-2026-93803wifi: libipw: fix key index receive bound checks
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: fix key index receive bound checks libipw_rx() reads skb->data[hdrlen + 3] to extract the WEP key index in both the software-decrypt key selection path and the hardware-decrypted IV/ICV strip path. In both places the existing guard only checks skb->len >= hdrlen + 3, which proves bytes up to hdrlen + 2 but not the byte at hdrlen + 3. Require hdrlen + 4 bytes before reading that item in both paths. This is a local source-boundary check only; it does not change the key index semantics.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 3, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from b453872c35cfcbdbf5a794737817f7d4e7b1b579 before bb18262c19feb690ddde58c70e3ad04bc6fe566e; from b453872c35cfcbdbf5a794737817f7d4e7b1b579 before 09d4a1bc3a08bb0e19bdf250b9f575cfef0bae82; from b453872c35cfcbdbf5a794737817f7d4e7b1b579 before 2836a870f612a8a6d9e390d00fa2cf6c90aa5808; from b453872c35cfcbdbf5a794737817f7d4e7b1b579 before 0b61c465ea62063593bc9ac186871b69e58ae991; from b453872c35cfcbdbf5a794737817f7d4e7b1b579 before 062840bdc9ee06169b3c371bf66711f1d7ec0bf4; from b453872c35cfcbdbf5a794737817f7d4e7b1b579 before c54b643e9a0936d038921c547736574fd7382cea; from b453872c35cfcbdbf5a794737817f7d4e7b1b579 before 74ed3669f26803b1761c1f55403062bea44c3466 | CNA record |
References
- https://git.kernel.org/stable/c/bb18262c19feb690ddde58c70e3ad04bc6fe566e
- https://git.kernel.org/stable/c/09d4a1bc3a08bb0e19bdf250b9f575cfef0bae82
- https://git.kernel.org/stable/c/2836a870f612a8a6d9e390d00fa2cf6c90aa5808
- https://git.kernel.org/stable/c/0b61c465ea62063593bc9ac186871b69e58ae991
- https://git.kernel.org/stable/c/062840bdc9ee06169b3c371bf66711f1d7ec0bf4
- https://git.kernel.org/stable/c/c54b643e9a0936d038921c547736574fd7382cea
- https://git.kernel.org/stable/c/74ed3669f26803b1761c1f55403062bea44c3466
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.