CVE-2026-93793: wifi: iwlwifi: mvm: validate TX_CMD response layout
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mvm: validate TXCMD response layout
TXCMD parsing uses framecount to walk status entries and then read the trailing SCD SSN. Make the minimum-length check follow that exact runtime layout calculation before parsing the payload.
For new TX API, reject TXCMD responses with framecount != 1 and warn/return in the aggregation handler to document that aggregated accounting is expected via BA notifications.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
For the new TX API, reject TX_CMD responses when frame_count != 1, calculate the exact runtime layout before parsing the payload, and warn/return from the aggregation handler when the layout is invalid.
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems running the Linux kernel with the iwlwifi MVM Wi-Fi driver are the relevant population. The issue is in processing TX_CMD responses, so exposure depends on that driver receiving malformed response data.
What input triggers the vulnerable parsing path?
A malformed TX_CMD response can cause the parser to walk status entries using frame_count and then read the trailing SCD SSN without a minimum-length check that matches the runtime layout. Under the new TX API, responses with a frame_count other than 1 are also rejected.
What should be done if an update cannot be applied immediately?
The provided information does not specify a workaround or configuration-based mitigation. The available remediation is the kernel fix that validates the response layout before parsing and rejects unsupported frame counts for the new TX API.