CVE-2026-93799 in Linux
Summary
by MITRE • 09/24/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mvm: validate sta_id in BA window status notif
BA_WINDOW_STATUS_NOTIFICATION_ID extracts a 5-bit sta_id from the firmware notification and uses it to index fw_id_to_mac_id[] without
bounds checking. Validate sta_id before array access to prevent out-of-bounds indexing.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/24/2026
The vulnerability identified within the Linux kernel's wireless networking subsystem, specifically in the iwlwifi driver for Intel Wireless WiFi Next Gen AGN and AC devices, represents a critical memory safety issue rooted in insufficient input validation. The core of this flaw lies in how the driver processes BA_WINDOW_STATUS_NOTIFICATION_ID messages received from the firmware. These notifications are essential for managing Block Acknowledgment windows, which optimize data transmission by allowing multiple frames to be acknowledged with a single response rather than individually acknowledging each frame. When such a notification is processed, the system extracts a five-bit station identifier, known as sta_id, directly from the incoming data structure without performing any preliminary checks on its validity or range.
This extracted sta_id value is subsequently used as an index into the fw_id_to_mac_id array, which serves to map firmware-specific identifiers to their corresponding MAC layer identifiers within the kernel's networking stack. Because the extraction process relies solely on a fixed five-bit width, it can yield values ranging from zero to thirty-one. However, there was no mechanism in place to verify whether this value corresponded to an actual valid station currently associated with the device or fell within the bounds of the fw_id_to_mac_id array itself. Consequently, if the firmware were to provide a sta_id that exceeds the allocated size of the array or refers to a non-existent entry, the driver would proceed to access memory at an invalid offset. This lack of bounds checking constitutes a classic out-of-bounds read vulnerability, classified under CWE-125 in industry standards for software weaknesses.
The operational impact of this flaw is significant due to its potential exploitation vectors and consequences. An attacker who can influence or manipulate the communication between the wireless firmware and the host driver could potentially trigger this code path with a crafted sta_id value. By doing so, they may cause an out-of-bounds read that exposes sensitive kernel memory contents to user space or triggers undefined behavior within the kernel execution context. Depending on the specific state of the system at the time of access, this could lead to information disclosure, where confidential data from adjacent memory regions is leaked, or it could result in a denial of service if the invalid access causes a page fault that crashes the kernel. In more complex scenarios involving subsequent processing of corrupted pointers derived from such reads, there exists a theoretical risk of remote code execution, although this typically requires additional conditions to be met. This type of vulnerability aligns with ATT&CK techniques related to privilege escalation and data exfiltration via memory corruption flaws in operating system components.
To mitigate this risk, the resolution involves implementing strict validation logic before any array indexing operation occurs within the BA window status notification handler. The driver must now verify that the extracted sta_id is both non-negative and less than the maximum valid index for the fw_id_to_mac_id array. If the value falls outside these acceptable bounds, the system should discard the malformed notification or log an error rather than proceeding with the unsafe memory access. This defensive programming approach ensures that only legitimate station identifiers are processed, thereby preserving the integrity of kernel memory structures. System administrators and users relying on affected Linux distributions should apply available security patches to update their kernels, ensuring that this boundary check is enforced during runtime operations involving Intel wireless hardware interactions.