HIGH Introduced in 3.9
iwlwifi TxResp OOB
CVE-2026-93793
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI8.0HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: validate TX_CMD response layout TX_CMD parsing uses frame_count to walk status entries and then read the trailing SCD SSN. Make the minimum-length check follow that exact runtime layout calculation before parsing the payload. For new TX API, reject TX_CMD responses with frame_count != 1 and warn/return in the aggregation handler to document that aggregated accounting is expected via BA notifications.
02KernelScan AI Analysis
Risk summary
The Intel iwlwifi WiFi driver fails to validate the layout of firmware TX command responses before parsing them. A malicious WiFi peer within radio range could influence the firmware to produce responses with unexpected frame counts, causing the driver to read beyond the allocated response buffer. This can leak kernel memory or crash the kernel, affecting any device using affected Intel WiFi hardware.
Vulnerability analysis
The WiFi driver uses a count provided by the firmware in a transmit response to walk through status entries and then read a trailing value at the end of the response. It did not verify that the response buffer was actually large enough to contain all the entries implied by that count. When the firmware supplies a larger count than the buffer can hold, the driver reads past the end of the buffer into adjacent kernel memory. The fix calculates the exact minimum size required for the reported count and discards any response that is too small. It also rejects responses with a count other than one when a newer firmware interface is in use. The bug is reached during normal wireless operation; an attacker only needs to be within radio range of a device using an affected Intel wireless adapter and can trigger it by sending crafted wireless traffic that causes the firmware to generate malformed transmit status reports.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 3.9 | 6.12.111 | fc14f5fe8a43 |
| 6.18 | 3.9 | 6.18.53 | 4d942dfc13ae |
| mainline | 3.9 | 7.2 | 8d70881707b4 |
| cip/6.12 | 3.9 | 6.12.111-cip32 | fc14f5fe8a43 |