CVE-2026-93807: wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers
In the Linux kernel, the following vulnerability has been resolved:
wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers
rsihalloadkey() copies txmickey and rxmickey from data[16] and data[24] whenever key data is present. Those offsets are only part of the 32-byte TKIP key layout. Shorter keys used by other ciphers, such as CCMP, do not provide those bytes, so the unconditional copies can read past the supplied key buffer.
Only copy the MIC keys for TKIP, and reject malformed TKIP keys that are shorter than the expected 32-byte layout.
[drop useless length check]
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel RSI Wi-Fi driver are affected when key material is loaded through rsi_hal_load_key(). The issue is relevant when non-TKIP ciphers with shorter key layouts, such as CCMP, are used.
What conditions trigger the out-of-bounds read?
The driver must process key data that is present but shorter than the 32-byte TKIP key layout. Before the fix, it unconditionally read MIC key bytes at offsets 16 and 24 even when the selected cipher was not TKIP.
What does the fix change?
The fix copies transmit and receive MIC keys only for TKIP keys. It also rejects TKIP key material shorter than the required 32-byte layout.
How can I determine whether a kernel includes the fix?
Check whether the kernel source or downstream patch set contains the change identified by the listed stable-kernel references. In the RSI driver, the corrected logic limits MIC-key copying to TKIP and validates malformed short TKIP keys.