CVE-2026-93790

HIGH 8.8

wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif

CVSS Score

8.8

EPSS Score

0.0%

EPSS Percentile

0th

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif mvmsta->tid_data was indexed by the TFD loop counter 'i' instead of the actual TID value 'tid'. This writes lq_color into a random tid_data slot unrelated to the BA entry. Since multi-TID blockack is not really in use, 'i' was always 0 and no harm was done. Add a out-of-bound check before accessing the array.

Vendor	linux
Product	linux
Ecosystems	Linux Kernel
Industries	Technology
Published	Sep 24, 2026
Last Updated	Oct 30, 2026

Stay Ahead of the Next One

Get instant alerts for linux linux

Be the first to know when new high vulnerabilities affecting linux linux are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

Linux / Linux

41fd2fec56db2564f02532ed7244e1f69193b4ad < ed9869e64dd7a397a320ae7a37f1e4a36f866f74 41fd2fec56db2564f02532ed7244e1f69193b4ad < 35f991d685feafd27255bd33272512c434e52527 41fd2fec56db2564f02532ed7244e1f69193b4ad < c48b741277b01b2c3b4ecccedc72fc575b71dc04 41fd2fec56db2564f02532ed7244e1f69193b4ad < e8ac5e91b1296f65c3d119fac3fa917ff458f811 41fd2fec56db2564f02532ed7244e1f69193b4ad < 94d3982806c7f194b23484befde12934dda23064

Linux / Linux

4.15

References

NVD ↗ CVE.org ↗ EPSS Data ↗

git.kernel.org: https://git.kernel.org/stable/c/ed9869e64dd7a397a320ae7a37f1e4a36f866f74 git.kernel.org: https://git.kernel.org/stable/c/35f991d685feafd27255bd33272512c434e52527 git.kernel.org: https://git.kernel.org/stable/c/c48b741277b01b2c3b4ecccedc72fc575b71dc04 git.kernel.org: https://git.kernel.org/stable/c/e8ac5e91b1296f65c3d119fac3fa917ff458f811 git.kernel.org: https://git.kernel.org/stable/c/94d3982806c7f194b23484befde12934dda23064