CVE-2026-93791: wifi: iwlwifi: mvm: add a check on the tid coming from the firmware
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mvm: add a check on the tid coming from the firmware
banotif->tid is a firmware-controlled u8 that is used directly as an array index into tiddata[] without any validation. Add a bounds check against IWLMAXTIDCOUNT before dereferencing the array.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the Linux kernel iwlwifi mvm code, validate the firmware-controlled ba_notif->tid against IWL_MAX_TID_COUNT before using it as an index into tid_data[].
Event History
Frequently Asked Questions
What input must be malformed for this issue to occur?
The issue requires firmware to provide a BA notification with a tid value outside the valid range for IWL_MAX_TID_COUNT. That firmware-controlled value was previously used directly to index the tid_data[] array.
Which systems are exposed?
Exposure is limited to Linux kernel systems using the iwlwifi mvm code path and receiving BA notifications from the relevant firmware. The provided information does not identify affected kernel versions or specific hardware models.
What changes in the fix?
The fix validates ba_notif->tid against IWL_MAX_TID_COUNT before dereferencing tid_data[]. Invalid TID values are therefore prevented from being used as array indexes.