CVE-2026-93063: wifi: iwlwifi: mei: check SAP message length before reading it
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mei: check SAP message length before reading it
Verify the SAP message size is not larger than the local buffer before reading the message to avoid buffer overflow.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the iwlwifi MEI SAP message handling, verify that the SAP message size is not larger than the local buffer before reading the message, preventing buffer overflow.
Event History
Frequently Asked Questions
What component must be in use for this issue to be relevant?
The affected code is in the Linux kernel's iwlwifi MEI integration. Systems without this specific wireless-driver and MEI code path in use are not indicated by the provided information as exposed.
What condition triggers the overflow?
The issue occurs when a SAP message is larger than the local buffer and is read without first validating its length. The fix adds a size check before reading the message.
How can I determine whether a kernel contains the fix?
Check whether the kernel source or vendor patch set includes one of the referenced stable commits: a4034f1cc8a422cefc519290d8e6cfb7ff773586, b90ebae632318dc2e5cd4ac96e454ec50f705579, or 9c6bea89a16815688a5240dd4a74c922a92fcdc3.