CVE-2026-93806: wifi: cfg80211: validate assoc response length before status and IE access
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: validate assoc response length before status and IE access
cfg80211rxassocresp() initialises the status and response-IE fields of cfg80211connectrespparams from the management frame before proving that the frame is long enough for those offsets. S1G and regular association responses also have different IE offsets, but the S1G path only patched respie after the unsafe initialiser had already run.
Defer respie, respielen, and status to after the link-iteration loop. Use a bool to remember whether the frame is S1G, then validate the appropriate minimum length and set all three fields in a single if/else block. Funnel short-frame and SME-reject cleanup through a shared freebss label for the abandon paths.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to do to trigger the flaw?
They need to cause the kernel to process a short or malformed association response frame. The issue occurs before the response length is validated for the fields accessed by cfg80211.
Is the issue limited to S1G Wi-Fi operation?
No. Both S1G and regular association responses are relevant because they use different information-element offsets; the unsafe initialization occurred before the S1G-specific adjustment.
How can I determine whether a fix is present?
Check whether the kernel includes the referenced stable commits. The available data does not identify affected or fixed kernel version numbers.