CVE-2026-98193

The Linux kernel contains a vulnerability in the libipw component where the libipw_michael_mic_verify() function incorrectly assumes the presence of an eight-byte Michael MIC. A short TKIP frame can cause the unsigned payload length to wrap, leading to an out-of-bounds read as michael_mic() reads...

EUVD-2026-93121

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject TKIP frames without a full MIC libipwmichaelmicverify assumes that an skb contains an eight-byte Michael MIC. A short TKIP frame makes the unsigned payload length wrap, causing michaelmic to read past the skb...