CVE-2026-93281 in Linux
Summary
by MITRE • 09/24/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw89: fix HE extended capability length check
rtw89_mac_check_he_obss_narrow_bw_ru_iter() reads extended capability byte 10, but rejects only datalen values below 10. Byte 10 requires at least 11 bytes.
Require datalen >= 11 before reading data[10].
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified in the Linux kernel's rtw89 wireless driver represents a critical off-by-one error within the handling of High Efficiency (HE) extended capability fields during Wi-Fi 6 operation. Specifically, the function rtw89_mac_check_he_obss_narrow_bw_ru_iter is responsible for parsing management frames to determine operational parameters related to overlapping basic service sets and narrow bandwidth resource units. The code logic attempts to access byte index ten of an extended capabilities array by checking if the total data length is less than ten bytes before proceeding with the read operation. This boundary check is technically insufficient because accessing a zero-indexed array at position ten requires that the array contain at least eleven elements, ranging from index zero through index ten. Consequently, when a frame contains exactly ten bytes of extended capability data, the condition datalen < 10 evaluates to false, allowing execution to proceed and resulting in an out-of-bounds read operation beyond the allocated memory buffer for that specific field.
This type of vulnerability is classified under CWE-125, which describes Out-of-Bounds Read vulnerabilities where software reads data past the end or before the beginning of the intended buffer. In the context of network-facing drivers like rtw89, such an error can lead to several adverse operational impacts depending on how the kernel handles memory access violations and what adjacent memory contents are exposed. An out-of-bounds read may leak sensitive kernel stack information into user space if the data is subsequently processed or logged, potentially aiding attackers in bypassing address space layout randomization protections. Furthermore, while less common for simple reads compared to writes, inconsistent state resulting from reading garbage values can lead to logic errors that might cause driver instability, packet processing failures, or denial of service conditions where the wireless interface becomes unresponsive due to malformed internal states derived from invalid capability data received from neighboring access points.
From a threat modeling perspective aligned with MITRE ATT&CK frameworks, this flaw falls under techniques associated with Discovery and potentially Initial Access if exploited in conjunction with other vulnerabilities. An attacker positioned within radio range of the affected device could craft specific beacon or probe response frames containing precisely sized HE extended capability fields to trigger the out-of-bounds read. While a pure information leak might not immediately grant code execution, it provides valuable intelligence about kernel memory layout and loaded modules, which is often a precursor step in more complex exploitation chains targeting privilege escalation. The vulnerability highlights the importance of rigorous bounds checking when parsing variable-length protocol headers where specific sub-fields have strict minimum length requirements that exceed simple index arithmetic checks.
To mitigate this risk, the primary remediation involves correcting the boundary condition within the rtw89 driver source code to enforce a stricter lower bound on the data length before accessing extended capability bytes. The fix requires changing the validation logic from checking for datalen less than ten to ensuring datalen is greater than or equal to eleven prior to any access of array index ten. This ensures that all requested indices fall within the valid memory range allocated for the frame payload. Additionally, developers should implement comprehensive fuzzing strategies targeting Wi-Fi management frames to detect similar off-by-one errors across other protocol parsers in the kernel. System administrators managing environments with rtw89-based hardware should apply available kernel updates or backported patches that address this specific logic error to prevent potential information disclosure and maintain the integrity of wireless network operations against crafted malicious frames from nearby adversaries.