CVE-2026-93803: wifi: libipw: fix key index receive bound checks
In the Linux kernel, the following vulnerability has been resolved:
wifi: libipw: fix key index receive bound checks
libipwrx() reads skb->data[hdrlen + 3] to extract the WEP key index in both the software-decrypt key selection path and the hardware-decrypted IV/ICV strip path. In both places the existing guard only checks skb->len >= hdrlen + 3, which proves bytes up to hdrlen + 2 but not the byte at hdrlen + 3.
Require hdrlen + 4 bytes before reading that item in both paths. This is a local source-boundary check only; it does not change the key index semantics.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In both the software-decrypt key-selection path and the hardware-decrypted path, require at least hdrlen + 4 bytes before reading the item at hdrlen + 3; update the existing skb->len boundary check accordingly.
Event History
Frequently Asked Questions
What packet condition reaches the out-of-bounds read?
The receive buffer must be short enough that it has only hdrlen + 3 bytes available while the code attempts to read the byte at offset hdrlen + 3. The corrected checks require at least hdrlen + 4 bytes before that read.
Which receive-processing paths were affected?
The issue existed in both the software-decrypt key-selection path and the hardware-decrypted IV/ICV stripping path in libipw_rx(). The fix changes only the receive-buffer length validation and does not alter key-index semantics.