CVE-2026-93793: wifi: iwlwifi: mvm: validate TX_CMD response layout
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mvm: validate TXCMD response layout
TXCMD parsing uses framecount to walk status entries and then read the trailing SCD SSN. Make the minimum-length check follow that exact runtime layout calculation before parsing the payload.
For new TX API, reject TXCMD responses with framecount != 1 and warn/return in the aggregation handler to document that aggregated accounting is expected via BA notifications.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.111-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.6-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.111-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.111 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.53 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
For the new TX API, reject TX_CMD responses whose frame_count is not equal to 1, and validate the minimum payload length using the exact runtime layout calculation before parsing.
- Compensating control
In the aggregation handler, warn and return; document that aggregated accounting is expected via BA notifications.
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems running the Linux kernel with the iwlwifi MVM Wi-Fi driver are the relevant population. The issue is in processing TX_CMD responses, so exposure depends on that driver receiving malformed response data.
What input triggers the vulnerable parsing path?
A malformed TX_CMD response can cause the parser to walk status entries using frame_count and then read the trailing SCD SSN without a minimum-length check that matches the runtime layout. Under the new TX API, responses with a frame_count other than 1 are also rejected.
What should be done if an update cannot be applied immediately?
The provided information does not specify a workaround or configuration-based mitigation. The available remediation is the kernel fix that validates the response layout before parsing and rejects unsupported frame counts for the new TX API.