CVE-2026-93799: wifi: iwlwifi: mvm: validate sta_id in BA window status notif
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mvm: validate staid in BA window status notif
BAWINDOWSTATUSNOTIFICATIONID extracts a 5-bit staid from the firmware notification and uses it to index fwidtomacid[] without bounds checking. Validate staid before array access to prevent out-of-bounds indexing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Validate the 5-bit sta_id extracted from BA_WINDOW_STATUS_NOTIFICATION_ID before using it to index fw_id_to_mac_id[], preventing out-of-bounds array access.
Event History
Frequently Asked Questions
What conditions are required to trigger the out-of-bounds access?
The iwlwifi MVM driver must process a BA window status notification from firmware containing a station ID that is invalid for the fw_id_to_mac_id[] array. The notification encodes the station ID in a 5-bit field.
Which systems are exposed?
Systems using the Linux kernel iwlwifi MVM Wi-Fi driver are relevant. The provided information does not identify affected kernel versions or specific Intel wireless hardware.
What does the fix change?
The fix validates the station ID before using it to index fw_id_to_mac_id[]. This prevents an invalid firmware-provided value from causing out-of-bounds indexing.