{"id":"CVE-2026-93784","summary":"wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: validate IEs in cfg80211_wext_siwgenie()\n\nThe KASAN allocation trace shows that a malformed IE buffer is\nstored via SIOCSIWGENIE (cfg80211_wext_siwgenie()) without any\nvalidation. The crash trace shows that a subsequent SIOCSIWESSID\ntriggers a connection attempt which calls cfg80211_sme_get_conn_ies()\nto process the stored IE buffer, causing:\n\n - An out-of-bounds read in skip_ie() which reads ies[pos+1]\n   (the length byte) past the end of the 1-byte buffer.\n\n - An integer underflow in the memcpy size argument when offs\n   returned by ieee80211_ie_split() exceeds ies_len, causing\n   unsigned subtraction to wrap to SIZE_MAX and triggering a\n   fortify panic.\n\nFix this by validating the IE buffer in cfg80211_wext_siwgenie()\nbefore storing it.\n\n[drop unnecessary ie_len check, update commit message]","modified":"2026-10-22T10:32:34.360906054Z","published":"2026-09-24T16:02:18.067Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93784.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/01cc395cecfaa73134d39fb9a401d9605d8bb2c5"},{"type":"WEB","url":"https://git.kernel.org/stable/c/269498ce6c1e2132b072aa0c8660404926008f03"},{"type":"WEB","url":"https://git.kernel.org/stable/c/685082f4be77f4657b498ebbe9f942ef65c492cf"},{"type":"WEB","url":"https://git.kernel.org/stable/c/8b921a8993469a3482e0c67b5ce5cb6ce93f5f61"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a2f5286ca4f304d3fd469f01b96b518608912a5c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c970879e03b23a27df42caf7ba506485a165fb96"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d01f1600e8b075aa17adb751ac9881bb6ee40dcc"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93784.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93784"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"f21293549f60f88c74fcb9944737f11048896dc4"},{"fixed":"269498ce6c1e2132b072aa0c8660404926008f03"},{"fixed":"685082f4be77f4657b498ebbe9f942ef65c492cf"},{"fixed":"8b921a8993469a3482e0c67b5ce5cb6ce93f5f61"},{"fixed":"d01f1600e8b075aa17adb751ac9881bb6ee40dcc"},{"fixed":"c970879e03b23a27df42caf7ba506485a165fb96"},{"fixed":"01cc395cecfaa73134d39fb9a401d9605d8bb2c5"},{"fixed":"a2f5286ca4f304d3fd469f01b96b518608912a5c"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-93784.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.32"},{"fixed":"5.10.271"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.222"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.189"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.158"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.111"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.53"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-93784.json"}}],"schema_version":"1.9.2"}