CVE-2026-93281: wifi: rtw89: fix HE extended capability length check
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw89: fix HE extended capability length check
rtw89maccheckheobssnarrowbwruiter() reads extended capability byte 10, but rejects only datalen values below 10. Byte 10 requires at least 11 bytes.
Require datalen >= 11 before reading data[10].
Affected Software
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems running the Linux kernel with the rtw89 Wi-Fi driver are relevant. Exposure requires the driver to process HE extended capability data whose length is too short to safely access byte 10.
What malformed input triggers the flawed check?
The affected function can read data[10] when the extended capability data length is 10 bytes. Accessing byte 10 requires a length of at least 11 bytes.
How can I determine whether the fix is present?
Check whether the kernel source includes a length validation requiring datalen to be at least 11 before data[10] is read in rtw89_mac_check_he_obss_narrow_bw_ru_iter(). The referenced stable commits contain the resolved change.