CVE-2026-98193

wifi: libipw: reject TKIP frames without a full MIC

State: Published
Severity: Not scored
Published: Oct 6, 2026
Updated: Oct 30, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: libipw: reject TKIP frames without a full MIC

libipw_michael_mic_verify() assumes that an skb contains an eight-byte Michael MIC. A short TKIP frame makes the unsigned payload length wrap, causing michael_mic() to read past the skb.

Check that the MIC is present before verifying it, and use the existing MICHAEL_MIC_LEN constant for all MIC lengths in the verifier.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	b453872c35cfcbdbf5a794737817f7d4e7b1b579 to before 2e23abdaf6d32aa112efaa474629af7584d3acc6Affected b453872c35cfcbdbf5a794737817f7d4e7b1b579 to before 9442bf5ea83314ef9a8a33e6885da45a61d1474dAffected b453872c35cfcbdbf5a794737817f7d4e7b1b579 to before 0636970f31dd9099f98578a62335eb534be72e3aAffected b453872c35cfcbdbf5a794737817f7d4e7b1b579 to before f448b267968d0ee985e5927c868c8f858169ab34Affected b453872c35cfcbdbf5a794737817f7d4e7b1b579 to before 9a7fb67364817710c96785ff86b71a2711ee92cbAffected b453872c35cfcbdbf5a794737817f7d4e7b1b579 to before ac7c08626f67844336086cf563f417566b76f0d7Affected b453872c35cfcbdbf5a794737817f7d4e7b1b579 to before bb7ae8910cc886885aea95abb7c2e578a2341646Affected b453872c35cfcbdbf5a794737817f7d4e7b1b579 to before 06f42accaf3c6aecab1dcc57f68dde6c06c8b380Affected
LinuxLinux	2.6.14Affected before 2.6.14Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.112 through 6.12.Not affected 6.18.54 through 6.18.Not affected 7.2.8 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

b453872c35cfcbdbf5a794737817f7d4e7b1b579 to before 2e23abdaf6d32aa112efaa474629af7584d3acc6Affected
b453872c35cfcbdbf5a794737817f7d4e7b1b579 to before 9442bf5ea83314ef9a8a33e6885da45a61d1474dAffected
b453872c35cfcbdbf5a794737817f7d4e7b1b579 to before 0636970f31dd9099f98578a62335eb534be72e3aAffected
b453872c35cfcbdbf5a794737817f7d4e7b1b579 to before f448b267968d0ee985e5927c868c8f858169ab34Affected
b453872c35cfcbdbf5a794737817f7d4e7b1b579 to before 9a7fb67364817710c96785ff86b71a2711ee92cbAffected
b453872c35cfcbdbf5a794737817f7d4e7b1b579 to before ac7c08626f67844336086cf563f417566b76f0d7Affected
b453872c35cfcbdbf5a794737817f7d4e7b1b579 to before bb7ae8910cc886885aea95abb7c2e578a2341646Affected
b453872c35cfcbdbf5a794737817f7d4e7b1b579 to before 06f42accaf3c6aecab1dcc57f68dde6c06c8b380Affected

LinuxLinux

2.6.14Affected
before 2.6.14Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.112 through 6.12.*Not affected
6.18.54 through 6.18.*Not affected
7.2.8 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.