{"id":"CVE-2026-93802","summary":"wifi: rsi: validate beacon length before fixed buffer copy","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rsi: validate beacon length before fixed buffer copy\n\nrsi_prepare_beacon() copies the mac80211 beacon frame after\nFRAME_DESC_SZ into a management skb whose usable tailroom may be smaller\nthan MAX_MGMT_PKT_SIZE after alignment.\n\nValidate the beacon length against the actual tailroom before the copy\nand skb_put(). Leave ownership of the management skb with the caller on\nerror, matching the existing rsi_send_beacon() cleanup path.","modified":"2026-10-22T10:30:21.685576870Z","published":"2026-09-24T16:02:36.341Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93802.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/266f195d5a14eec6c482fd09fbc924584c3371a7"},{"type":"WEB","url":"https://git.kernel.org/stable/c/66a964432b2758a4cf69962366e37581d6e70632"},{"type":"WEB","url":"https://git.kernel.org/stable/c/795ba65f46fe44061f1195951c122cc8ec685d44"},{"type":"WEB","url":"https://git.kernel.org/stable/c/7f99742c3c2801f8033d8b7a0a58254d7f24fb1e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/87710ad633ce4588aec88611d0d0745eb33a6991"},{"type":"WEB","url":"https://git.kernel.org/stable/c/8ecdeb8b8a33b22c597299043c0dcfce50beb9ea"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f08d7f3c916335a0e539f1c45c130615967fac47"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93802.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93802"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"d26a9559403c7c3ec3b430f5825bc22c3d40abdb"},{"fixed":"795ba65f46fe44061f1195951c122cc8ec685d44"},{"fixed":"66a964432b2758a4cf69962366e37581d6e70632"},{"fixed":"7f99742c3c2801f8033d8b7a0a58254d7f24fb1e"},{"fixed":"f08d7f3c916335a0e539f1c45c130615967fac47"},{"fixed":"87710ad633ce4588aec88611d0d0745eb33a6991"},{"fixed":"266f195d5a14eec6c482fd09fbc924584c3371a7"},{"fixed":"8ecdeb8b8a33b22c597299043c0dcfce50beb9ea"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-93802.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.14.0"},{"fixed":"5.10.271"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.222"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.189"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.158"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.111"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.53"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-93802.json"}}],"schema_version":"1.9.2"}