CVE-2026-93784: wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie()
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: validate IEs in cfg80211wextsiwgenie()
The KASAN allocation trace shows that a malformed IE buffer is stored via SIOCSIWGENIE (cfg80211wextsiwgenie()) without any validation. The crash trace shows that a subsequent SIOCSIWESSID triggers a connection attempt which calls cfg80211smegetconnies() to process the stored IE buffer, causing:
- An out-of-bounds read in skipie() which reads ies[pos+1] (the length byte) past the end of the 1-byte buffer.
- An integer underflow in the memcpy size argument when offs returned by ieee80211iesplit() exceeds ieslen, causing unsigned subtraction to wrap to SIZEMAX and triggering a fortify panic.
Fix this by validating the IE buffer in cfg80211wextsiwgenie() before storing it.
[drop unnecessary ielen check, update commit message]
Affected Software
Event History
Frequently Asked Questions
What must an attacker be able to do to trigger this issue?
An attacker needs the ability to submit a malformed wireless information-element buffer through the SIOCSIWGENIE wireless-extension interface, then trigger a connection attempt through SIOCSIWESSID. The malformed buffer is processed later when cfg80211 handles the connection request.
What is the impact if the vulnerable path is reached?
Processing a one-byte or otherwise malformed IE buffer can cause an out-of-bounds read while reading an IE length byte. It can also cause an unsigned length underflow in a memcpy operation, wrapping to SIZE_MAX and triggering a fortify panic.
How can I tell whether a system is exposed to the vulnerable behavior?
The vulnerable behavior is present if cfg80211_wext_siwgenie() stores IE data received through SIOCSIWGENIE without validating it before a later connection attempt processes it. Relevant failure evidence includes KASAN reports involving skip_ie() or a fortify panic caused by a memcpy size wrapping to SIZE_MAX during cfg80211_sme_get_conn_ies().
What does the fix change?
The fix validates the IE buffer in cfg80211_wext_siwgenie() before storing it. This prevents malformed IE data supplied through SIOCSIWGENIE from reaching the later connection-IE parsing path.