HIGH Introduced in 4.15
iwlwifi BaNotif OOB
CVE-2026-93790
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI8.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif mvmsta->tid_data was indexed by the TFD loop counter 'i' instead of the actual TID value 'tid'. This writes lq_color into a random tid_data slot unrelated to the BA entry. Since multi-TID blockack is not really in use, 'i' was always 0 and no harm was done. Add a out-of-bound check before accessing the array.
02KernelScan AI Analysis
Risk summary
An out-of-bounds array access in the Intel iwlwifi WiFi driver's block-ack notification handler could corrupt an unrelated per-TID data slot when processing received WiFi frames. An attacker within WiFi range could trigger this by sending frames that produce a block-ack notification with an unexpected TID value. The commit notes that in practice the loop counter was always zero, so no actual out-of-bounds write occurred, limiting real-world impact to a wrong-slot write with minimal consequences.
Vulnerability analysis
When the WiFi firmware sends a block-ack notification, the driver iterates over transmitted frame descriptors and updates a per-station, per-TID data structure. The original code indexed this array using the loop counter rather than the actual TID value extracted from the notification, causing the write to land in the wrong array slot. If multi-TID block-ack were ever used, the loop counter could exceed the array bounds, producing an out-of-bounds write into adjacent kernel memory. The fix adds an explicit bounds check on the TID value before array access and corrects the index to use the actual TID. This path is reached solely through WiFi frame reception — an attacker needs no shell or privileges, only proximity to send crafted WiFi frames to the target device. The driver requires Intel iwlwifi hardware to be present and active.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.6 | 4.15 | 6.6.158 | 35f991d685fe |
| 6.12 | 4.15 | 6.12.111 | c48b741277b0 |
| 6.18 | 4.15 | 6.18.53 | e8ac5e91b129 |
| mainline | 4.15 | 7.2 | 94d3982806c7 |
| cip/6.12 | 4.15 | 6.12.111-cip32 | c48b741277b0 |