UBUNTU-CVE-2026-93793: Medium severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: validate TXCMD response layout TXCMD parsing uses framecount to walk status entries and then read the trailing SCD SSN. Make the minimum-length check follow that exact runtime layout calculation before parsing the payload. For new TX API, reject TXCMD responses with framecount != 1 and warn/return in the aggregation handler to document that aggregated accounting is expected via BA notifications.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
For the new TX API, reject TX_CMD responses when frame_count != 1; in the aggregation handler, warn and return, documenting that aggregated accounting is expected through BA notifications.
- Compensating control
Before parsing a TX_CMD response payload, validate its minimum length using the exact runtime layout calculation derived from frame_count, including the status entries and trailing SCD SSN.
Event History
Frequently Asked Questions
Which systems are most relevant to assess?
Assess Ubuntu systems running one of the listed linux kernel packages that use the iwlwifi MVM Wi-Fi driver. Systems without affected Intel Wi-Fi hardware or without that driver in use are not the primary exposure population described by the fix.
What level of attacker access is indicated?
The supplied vector rates attack vector as adjacent network, with no privileges or user interaction required. It also indicates attack requirements are present, so an attacker must satisfy an additional unspecified condition beyond being on an adjacent network.