CVE-2026-93802: wifi: rsi: validate beacon length before fixed buffer copy
In the Linux kernel, the following vulnerability has been resolved:
wifi: rsi: validate beacon length before fixed buffer copy
rsipreparebeacon() copies the mac80211 beacon frame after FRAMEDESCSZ into a management skb whose usable tailroom may be smaller than MAXMGMTPKTSIZE after alignment.
Validate the beacon length against the actual tailroom before the copy and skbput(). Leave ownership of the management skb with the caller on error, matching the existing rsisendbeacon() cleanup path.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running the Linux kernel with the rsi Wi-Fi driver are relevant. Exposure requires use of the affected beacon preparation path in that driver.
What condition is required to trigger the flaw?
A beacon frame must be copied into a management skb whose actual usable tailroom is smaller than the beacon length after the frame descriptor offset. The vulnerable code did not validate the length against the available tailroom before copying and extending the skb.
How can administrators determine whether the fix is present?
Check whether the kernel includes one of the referenced stable commits: 87710ad633ce4588aec88611d0d0745eb33a6991, 266f195d5a14eec6c482fd09fbc924584c3371a7, or 8ecdeb8b8a33b22c597299043c0dcfce50beb9ea. The fix validates the beacon length against the management skb's actual tailroom before the copy and skb_put().