CVE-2026-93790: wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mvm: fix out-of-bounds tiddata access in BA notif
mvmsta->tiddata was indexed by the TFD loop counter 'i' instead of the actual TID value 'tid'. This writes lqcolor into a random tiddata slot unrelated to the BA entry. Since multi-TID blockack is not really in use, 'i' was always 0 and no harm was done. Add a out-of-bound check before accessing the array.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In iwlwifi mvm BA notification handling, add an out-of-bounds check before accessing the array and index mvmsta->tid_data by the actual TID value 'tid' rather than the TFD loop counter 'i'.
Event History
Frequently Asked Questions
Is this likely to be exploitable in typical deployments?
The description states that multi-TID block acknowledgment is not really in use. As a result, the loop counter was always 0 and no harm was done in the described condition.
What code path is affected?
The issue is in the iwlwifi MVM handling of BA notifications, where tid_data was indexed with the TFD loop counter instead of the actual TID. The fix adds an out-of-bounds check before accessing the array.