CVE-2026-93803

wifi: libipw: fix key index receive bound checks

State: Published
Severity: Not scored
Published: Sep 24, 2026
Updated: Oct 3, 2026
Reserved: Sep 18, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: libipw: fix key index receive bound checks

libipw_rx() reads skb->data[hdrlen + 3] to extract the WEP key index in both the software-decrypt key selection path and the hardware-decrypted IV/ICV strip path. In both places the existing guard only checks skb->len >= hdrlen + 3, which proves bytes up to hdrlen + 2 but not the byte at hdrlen + 3.

Require hdrlen + 4 bytes before reading that item in both paths. This is a local source-boundary check only; it does not change the key index semantics.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	b453872c35cfcbdbf5a794737817f7d4e7b1b579 to before bb18262c19feb690ddde58c70e3ad04bc6fe566eAffected b453872c35cfcbdbf5a794737817f7d4e7b1b579 to before 09d4a1bc3a08bb0e19bdf250b9f575cfef0bae82Affected b453872c35cfcbdbf5a794737817f7d4e7b1b579 to before 2836a870f612a8a6d9e390d00fa2cf6c90aa5808Affected b453872c35cfcbdbf5a794737817f7d4e7b1b579 to before 0b61c465ea62063593bc9ac186871b69e58ae991Affected b453872c35cfcbdbf5a794737817f7d4e7b1b579 to before 062840bdc9ee06169b3c371bf66711f1d7ec0bf4Affected b453872c35cfcbdbf5a794737817f7d4e7b1b579 to before c54b643e9a0936d038921c547736574fd7382ceaAffected b453872c35cfcbdbf5a794737817f7d4e7b1b579 to before 74ed3669f26803b1761c1f55403062bea44c3466Affected
LinuxLinux	2.6.14Affected before 2.6.14Not affected 5.10.271 through 5.10.Not affected 5.15.222 through 5.15.Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.111 through 6.12.Not affected 6.18.53 through 6.18.Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

b453872c35cfcbdbf5a794737817f7d4e7b1b579 to before bb18262c19feb690ddde58c70e3ad04bc6fe566eAffected
b453872c35cfcbdbf5a794737817f7d4e7b1b579 to before 09d4a1bc3a08bb0e19bdf250b9f575cfef0bae82Affected
b453872c35cfcbdbf5a794737817f7d4e7b1b579 to before 2836a870f612a8a6d9e390d00fa2cf6c90aa5808Affected
b453872c35cfcbdbf5a794737817f7d4e7b1b579 to before 0b61c465ea62063593bc9ac186871b69e58ae991Affected
b453872c35cfcbdbf5a794737817f7d4e7b1b579 to before 062840bdc9ee06169b3c371bf66711f1d7ec0bf4Affected
b453872c35cfcbdbf5a794737817f7d4e7b1b579 to before c54b643e9a0936d038921c547736574fd7382ceaAffected
b453872c35cfcbdbf5a794737817f7d4e7b1b579 to before 74ed3669f26803b1761c1f55403062bea44c3466Affected

LinuxLinux

2.6.14Affected
before 2.6.14Not affected
5.10.271 through 5.10.*Not affected
5.15.222 through 5.15.*Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.111 through 6.12.*Not affected
6.18.53 through 6.18.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.