CVE-2026-56101: OpenBSD ieee80211_crypto_tkip.c TKIP MIC Countermeasure Logic Inversion DoS
OpenBSD before commit 1ee99df contains an inverted comparison vulnerability in the ieee80211michaelmicfailure() function within sys/net80211/ieee80211cryptotkip.c that allows unauthenticated attackers within RF range to trigger denial of service by sending two malformed TKIP frames separated by more than 60 seconds. Attackers can exploit the reversed TKIP MIC failure countermeasure window check to deauthenticate all associated TKIP stations and block reassociation for up to 90 seconds, while within-window MIC failures that should engage countermeasures are silently discarded, leaving key-recovery attempts undetected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenBSD sys/net80211/ieee80211_crypto_tkip.c (ieee80211_michael_mic_failure() TKIP MIC failure countermeasure logic inversion)to a version that resolves this vulnerability.Patch 1ee99df
Event History
Frequently Asked Questions
Which systems are exposed to this denial of service?
OpenBSD systems that use associated TKIP wireless stations are exposed. The attacker must be within RF range of the target wireless network.
What does an attacker need to do to trigger the disruption?
No authentication or user interaction is required. An attacker can send two malformed TKIP frames more than 60 seconds apart to deauthenticate associated TKIP stations and prevent reassociation for up to 90 seconds.
Are all malformed TKIP MIC failures handled as intended?
No. MIC failures occurring within the intended countermeasure window are silently discarded rather than engaging countermeasures, which can leave key-recovery attempts undetected.
What version or code state resolves the issue?
The issue affects OpenBSD before commit 1ee99df. Systems containing that commit are not described as affected.