CVE-2026-93807

The Linux kernel contains a vulnerability in the wifi: rsi component where the rsi_hal_load_key() function performs unconditional copies of tx_mic_key and rx_mic_key from specific offsets within the key data. Because these offsets are part of the 32-byte TKIP key layout, using shorter keys for ot...

CVE-2026-93806

The Linux kernel contains a vulnerability in the cfg80211 wifi component. The cfg80211_rx_assoc_resp() function incorrectly initializes the status and response-IE fields of cfg80211_connect_resp_params from a management frame before verifying that the frame is long enough to accommodate those off...

EUVD-2026-86193

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate assoc response length before status and IE access cfg80211rxassocresp initialises the status and response-IE fields of cfg80211connectrespparams from the management frame before proving that the frame is...

CVE-2026-93805

The Linux kernel contains a vulnerability in the cfg80211 component where cfg80211_rx_mlme_mgmt() and cfg80211_tx_mlme_mgmt() fail to properly validate the lengths of MLME callback frames before accessing their contents. Specifically, the functions only verify that frames are at least 2 bytes lon...

EUVD-2026-86192

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate rx/tx MLME callback frame lengths before access cfg80211rxmlmemgmt and cfg80211txmlmemgmt call tracepoints before rejecting frames shorter than the frame-control field. After that, they only require len =...

CVE-2026-93805 wifi: cfg80211: validate rx/tx MLME callback frame lengths before access

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate rx/tx MLME callback frame lengths before access cfg80211rxmlmemgmt and cfg80211txmlmemgmt call tracepoints before rejecting frames shorter than the frame-control field. After that, they only require len =...

CVE-2026-93805 wifi: cfg80211: validate rx/tx MLME callback frame lengths before access

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate rx/tx MLME callback frame lengths before access cfg80211rxmlmemgmt and cfg80211txmlmemgmt call tracepoints before rejecting frames shorter than the frame-control field. After that, they only require len =...

CVE-2026-93803

The Linux kernel contains a vulnerability in the libipw component where libipw_rx() fails to perform adequate bound checks when extracting the WEP key index . The function reads skb->data[hdrlen + 3], but the existing guard only ensures skb->len >= hdrlen + 3, which does not guarantee th...

CVE-2026-93803 wifi: libipw: fix key index receive bound checks

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: fix key index receive bound checks libipwrx reads skb-datahdrlen + 3 to extract the WEP key index in both the software-decrypt key selection path and the hardware-decrypted IV/ICV strip path. In both places the...

EUVD-2026-86190

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: fix key index receive bound checks libipwrx reads skb-datahdrlen + 3 to extract the WEP key index in both the software-decrypt key selection path and the hardware-decrypted IV/ICV strip path. In both places the...

CVE-2026-93787 smb: client: bound dirent name against end of SMB response in cifs_filldir

In the Linux kernel, the following vulnerability has been resolved: smb: client: bound dirent name against end of SMB response in cifsfilldir cifsfilldir copies the entry name out of an SMB1 TRANS2FINDFIRST / FINDNEXT response using a length de.namelen supplied by the server. The kmalloc'd SMB...

CVE-2026-93787

The Linux kernel contains a vulnerability in the SMB1 client where cifs_filldir() fails to verify if the entry name length provided by a server stays within the bounds of the allocated SMB response buffer. A hostile SMB1 server can return an oversized FileNameLength , causing memchr() to perform ...

CVE-2026-93787 smb: client: bound dirent name against end of SMB response in cifs_filldir

In the Linux kernel, the following vulnerability has been resolved: smb: client: bound dirent name against end of SMB response in cifsfilldir cifsfilldir copies the entry name out of an SMB1 TRANS2FINDFIRST / FINDNEXT response using a length de.namelen supplied by the server. The kmalloc'd SMB...

EUVD-2026-86174

In the Linux kernel, the following vulnerability has been resolved: smb: client: bound dirent name against end of SMB response in cifsfilldir cifsfilldir copies the entry name out of an SMB1 TRANS2FINDFIRST / FINDNEXT response using a length de.namelen supplied by the server. The kmalloc'd SMB...

EUVD-2026-86171

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate IEs in cfg80211wextsiwgenie The KASAN allocation trace shows that a malformed IE buffer is stored via SIOCSIWGENIE cfg80211wextsiwgenie without any validation. The crash trace shows that a subsequent...

CVE-2026-93784

A vulnerability exists in the Linux kernel 's cfg80211 component. The function cfg80211_wext_siwgenie() fails to validate the IE buffer stored via SIOCSIWGENIE , leading to an out-of-bounds read in skip_ie() and an integer underflow in memcpy during a subsequent SIOCSIWESSID connection attempt. T...

CVE-2026-93784 wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie()

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate IEs in cfg80211wextsiwgenie The KASAN allocation trace shows that a malformed IE buffer is stored via SIOCSIWGENIE cfg80211wextsiwgenie without any validation. The crash trace shows that a subsequent...

CVE-2026-93784 wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie()

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate IEs in cfg80211wextsiwgenie The KASAN allocation trace shows that a malformed IE buffer is stored via SIOCSIWGENIE cfg80211wextsiwgenie without any validation. The crash trace shows that a subsequent...

CVE-2026-93783

The Linux kernel contains a vulnerability in the Bluetooth RFCOMM component within the rfcomm_recv_frame() function. The root cause is a missing length validation when casting skb->data to struct rfcomm_hdr. This allows a truncated frame to trigger an out-of-bounds read of uninitialized memory...

CVE-2026-93783 Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in rfcommrecvframe rfcommrecvframe casts skb-data to struct rfcommhdr and dereferences hdr-addr and hdr-ctrl without validating skb-len first. A truncated frame with skb-len less than the...