78 matches found
CVE-2026-56101
OpenBSD before commit 1ee99df contains an inverted comparison vulnerability in the ieee80211michaelmicfailure function within sys/net80211/ieee80211cryptotkip.c that allows unauthenticated attackers within RF range to trigger denial of service by sending two malformed TKIP frames separated by mor...
EUVD-2026-72935
OpenBSD before commit 1ee99df contains an inverted comparison vulnerability in the ieee80211michaelmicfailure function within sys/net80211/ieee80211cryptotkip.c that allows unauthenticated attackers within RF range to trigger denial of service by sending two malformed TKIP frames separated by mor...
CVE-2026-56101
OpenBSD before commit 1ee99df contains an inverted comparison in the ieee80211_michael_mic_failure() function within sys/net80211/ieee80211_crypto_tkip.c. The reversed TKIP MIC failure countermeasure window check allows unauthenticated attackers within RF range to send two malformed TKIP frames s...
Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-5.10
In the Linux kernel, the following vulnerability has been resolved: Wifi: iwlwifi: dvm – Fixed a issue where memcpy was used for writing data that spanned multiple fields. The received TKIP key may be up to 32 bytes, as it may also contain MIC rx/tx keys. These keys are not used by iwlwifi, and...
UBUNTU-CVE-2026-74368
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix memory leak in ath12kwifi7dprxhverifytkipmic In ath12kwifi7dprxhverifytkipmic, the call to ath12kdprxchecknwifihdrlenvalid may return false when the NWIFI header length is invalid, causing the function to abort...
CVE-2026-74368
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix memory leak in ath12kwifi7dprxhverifytkipmic In ath12kwifi7dprxhverifytkipmic, the call to ath12kdprxchecknwifihdrlenvalid may return false when the NWIFI header length is invalid, causing the function to abort...
CVE-2026-74368
The CVE-2026-74368 entry documents a memory leak in the Linux kernel’s ath12k wifi path (ath12k_wifi7_dp_rx_h_verify_tkip_mic) triggered when NWIFI header length validation fails. The root cause is a false return from ath12k_dp_rx_check_nwifi_hdr_len_valid() for invalid NWIFI headers, causing ear...
CVE-2026-74368 wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic()
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix memory leak in ath12kwifi7dprxhverifytkipmic In ath12kwifi7dprxhverifytkipmic, the call to ath12kdprxchecknwifihdrlenvalid may return false when the NWIFI header length is invalid, causing the function to abort...
Linux Distros Unpatched Vulnerability : CVE-2026-74368
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wifi: ath12k: fix memory leak in ath12kwifi7dprxhverifytkipmic In ath12kwifi7dprxhverifytkipmic, the call to ath12kdprxchecknwifihdrlenvalid may return false wh...
UBUNTU-CVE-2026-64536
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in isapintkip IE loop The loop in isapintkip iterates over IEs without verifying that enough bytes remain before dereferencing the IE header or its payload: - pIE-elementid and pIE-length are rea...
CVE-2026-64536
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in isapintkip IE loop The loop in isapintkip iterates over IEs without verifying that enough bytes remain before dereferencing the IE header or its payload: - pIE-elementid and pIE-length are rea...
CVE-2026-64536 staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in isapintkip IE loop The loop in isapintkip iterates over IEs without verifying that enough bytes remain before dereferencing the IE header or its payload: - pIE-elementid and pIE-length are rea...
PT-2026-64860
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the is ap in tkip function within the rtl8723bs staging driver. The function iterates over Information Elements IEs without verifying if sufficient bytes...
Astra Linux – Vulnerability in Linux
A issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The Wi-Fi implementation does not verify the Message Integrity Check authenticity of fragmented TKIP frames. An adversary can exploit this vulnerability to inject and potentially decrypt packets in WPA or WPA2 networks...
SUSE CVE-2023-54286
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace A received TKIP key may be up to 32 bytes because it may contain MIC rx/tx keys too. These are not used by iwl and copying these over overflows the...
CVE-2023-54286
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace A received TKIP key may be up to 32 bytes because it may contain MIC rx/tx keys too. These are not used by iwl and copying these over overflows the...
CVE-2023-54286
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace A received TKIP key may be up to 32 bytes because it may contain MIC rx/tx keys too. These are not used by iwl and copying these over overflows the...
CVE-2023-54286
In CVE-2023-54286, the Linux kernel WiFi driver iwlwifi/dvm (sta.c) allowed a TKIP key payload that could exceed the iwl_keyinfo.key buffer due to copying MIC keys along with the TKIP key. The root cause was a field-spanning write during memcpy that could overflow the destination, potentially ena...
CVE-2023-54286 wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace A received TKIP key may be up to 32 bytes because it may contain MIC rx/tx keys too. These are not used by iwl and copying these over overflows the...