CVE-2026-93790

wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif

State: Published
Severity: 8.8 High
Published: Sep 24, 2026
Updated: Oct 30, 2026
Reserved: Sep 18, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif

mvmsta->tid_data was indexed by the TFD loop counter 'i' instead of the actual TID value 'tid'. This writes lq_color into a random tid_data slot unrelated to the BA entry. Since multi-TID blockack is not really in use, 'i' was always 0 and no harm was done. Add a out-of-bound check before accessing the array.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	41fd2fec56db2564f02532ed7244e1f69193b4ad to before ed9869e64dd7a397a320ae7a37f1e4a36f866f74Affected 41fd2fec56db2564f02532ed7244e1f69193b4ad to before 35f991d685feafd27255bd33272512c434e52527Affected 41fd2fec56db2564f02532ed7244e1f69193b4ad to before c48b741277b01b2c3b4ecccedc72fc575b71dc04Affected 41fd2fec56db2564f02532ed7244e1f69193b4ad to before e8ac5e91b1296f65c3d119fac3fa917ff458f811Affected 41fd2fec56db2564f02532ed7244e1f69193b4ad to before 94d3982806c7f194b23484befde12934dda23064Affected
LinuxLinux	4.15Affected before 4.15Not affected 6.1.191 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.111 through 6.12.Not affected 6.18.53 through 6.18.Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

41fd2fec56db2564f02532ed7244e1f69193b4ad to before ed9869e64dd7a397a320ae7a37f1e4a36f866f74Affected
41fd2fec56db2564f02532ed7244e1f69193b4ad to before 35f991d685feafd27255bd33272512c434e52527Affected
41fd2fec56db2564f02532ed7244e1f69193b4ad to before c48b741277b01b2c3b4ecccedc72fc575b71dc04Affected
41fd2fec56db2564f02532ed7244e1f69193b4ad to before e8ac5e91b1296f65c3d119fac3fa917ff458f811Affected
41fd2fec56db2564f02532ed7244e1f69193b4ad to before 94d3982806c7f194b23484befde12934dda23064Affected

LinuxLinux

4.15Affected
before 4.15Not affected
6.1.191 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.111 through 6.12.*Not affected
6.18.53 through 6.18.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.