CVE-2026-93063: wifi: iwlwifi: mei: check SAP message length before reading it
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mei: check SAP message length before reading it
Verify the SAP message size is not larger than the local buffer before reading the message to avoid buffer overflow.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify the wifi: iwlwifi: mei code path to verify the SAP message length is not larger than the local buffer before reading the SAP message, to prevent a buffer overflow.
Linux kernel (wifi: iwlwifi: mei) SAP message length check before reading = Verify SAP message size is not larger than the local buffer
Event History
Frequently Asked Questions
What component must be in use for this issue to be relevant?
The affected code is in the Linux kernel's iwlwifi MEI integration. Systems without this specific wireless-driver and MEI code path in use are not indicated by the provided information as exposed.
What condition triggers the overflow?
The issue occurs when a SAP message is larger than the local buffer and is read without first validating its length. The fix adds a size check before reading the message.
How can I determine whether a kernel contains the fix?
Check whether the kernel source or vendor patch set includes one of the referenced stable commits: a4034f1cc8a422cefc519290d8e6cfb7ff773586, b90ebae632318dc2e5cd4ac96e454ec50f705579, or 9c6bea89a16815688a5240dd4a74c922a92fcdc3.