EUVD-2026-93333
GHSA-jch8-34rh-p8cm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessPosition within wireless range
-
DeliverySpoof AP and send truncated association response
-
ExploitTrigger size_t length underflow in libipw_handle_assoc_resp
-
ExecutionParser over-reads past receive buffer
-
ImpactKernel panic / adjacent memory disclosure
Vulnerability Assessment
| Exploitation Conditions | The target must be running the Linux legacy libipw stack with the ipw2100 or ipw2200 wireless driver (Intel PRO/Wireless 2100 and 2200BG era hardware) and be actively processing association responses in station mode. The attacker must be within wireless/adjacent range (AV:A) and able to send or inject a crafted association response frame that carries the generic 24-byte three-address management header but is shorter than the 30-byte fixed association-response prefix, so the IE-length subtraction underflows. Limiting factors: exploitation is confined to wireless proximity (not remote), depends entirely on the presence of these obsolete drivers (default on virtually no modern deployment), and the primary realistic outcome is a kernel crash (A:H) rather than reliable code execution; no authentication (PR:N) or user interaction (UI:N) is otherwise required. |
| Impact | Despite a HIGH 7.1 CVSS base score, converging signals point to LOW real-world priority. The vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H confirms this is adjacent-network only (AV:A) - the attacker must be within wireless range and acting as or spoofing an access point that sends a malicious association response; it is not remotely reachable over the internet. Although PR:N/UI:N means no authentication or user interaction is needed, exploitation is gated by the victim actively running the legacy ipw2100/ipw2200 drivers and attempting to associate. EPSS corroborates the low-urgency picture: 0.17% probability at the 6th percentile. The CVE is NOT in CISA KEV and no POC is referenced, so there is no public exploit identified at time of analysis. Impact is dominated by availability (A:H, a KASAN-detectable out-of-bounds read that would panic the kernel) with only partial confidentiality exposure (C:L) from the over-read; I:N means no integrity impact and S:U means no scope change. The signals are consistent rather than conflicting - the main caveat is that the affected code paths serve nearly-extinct Intel PRO/Wireless hardware, so even a working exploit would find few targets. Note the input Tags label this 'Information Disclosure' while the CVSS weighting emphasizes availability (A:H) over confidentiality (C:L); both effects are plausible for a buffer over-read, so treat the tag as partially accurate rather than wrong. |
| Exploit ScenarioDerived | An attacker within wireless range operates a rogue access point and lures a victim machine running the ipw2100 or ipw2200 driver into an association exchange. The attacker returns an association response frame shorter than the 30-byte fixed prefix, causing the information-element length computation (stats->len - sizeof(*frame)) to underflow to roughly 64 KiB and the parser to read far past the receive buffer, crashing the kernel and potentially leaking adjacent memory. No public exploit code is identified at time of analysis, and exploitation requires adjacent (AV:A) wireless proximity rather than remote access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Out-of-bounds reads in the Linux kernel's legacy libipw 802.11 management-frame parser, reachable through the ipw2100 and ipw2200 wireless drivers, let an unauthenticated attacker within wireless range crash the kernel by injecting a crafted association response that is shorter than the fixed 30-byte prefix. The root cause is an unsigned integer underflow: stats->len (u16) minus sizeof(*frame) (size_t) is evaluated in size_t and wraps, so the truncated u16 length handed to libipw_parse_info_param becomes a value near 64 KiB and the information-element parser walks well past the receive buffer. Exploitation requires the obsolete Intel PRO/Wireless 2100 or 2200BG hardware and driver stack to be present and processing association responses, so the realistic outcome is a denial-of-service kernel crash with only limited disclosure potential; no public exploit code has been identified at time of analysis, no KEV entry exists, and EPSS is a low 0.17% (6th percentile), while vendor-released patches are available in the 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4 kernels.
RemediationAI
Apply the vendor-released kernel patches containing the libipw fix: upgrade to 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 or 7.3-rc4 (or later), which include commits such as 766268b429ae26d8ca599031fa962b0fe4673120, d70bdb84cf1782039384c1ffa7a18b0303c286a7, 400b89217058fac672134a0d4092c8493dadb8ad, 46aa75291056b6dc5faaf956dffdb3e9662477b0, e3025ecdb2057f866c09e059fc1466e81d6f243e, 14cb425ba1f3a5d849e3bbc3d02d84e0ae195dbb and af1b69be19c34e28c0ae54bee954b58cd076969a as mirrored on https://git.kernel.org/stable/. Because the vulnerable code only runs on obsolete Intel PRO/Wireless 2100/2200BG hardware, the most practical compensating control is to remove the drivers entirely: blacklist them with modprobe.blacklist=ipw2100,ipw2200 (or disable CONFIG_IPW2100/CONFIG_IPW2200 in the kernel build), at the cost of losing wireless connectivity for that hardware. Alternatively, restrict these devices to trusted networks and avoid station-mode associations on open or untrusted WLANs, and limit physical/wireless proximity to the affected equipment; these reduce exposure but do not eliminate the underflow path, and no mitigation short of the kernel patch changes the parser's behavior.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected code is libipw, the shared 802.11 stack used by the Intel PRO/Wireless 2100 (ipw2100) and 2200BG (ipw2200) drivers, tracked as cpe:2.3:a:linux:linux in the kernel tree. In libipw_handle_assoc_resp(), the driver first reads the capability, status and aid fields from the fixed 30-byte association-response prefix and then computes the information-element length as stats->len - sizeof(*frame). Because stats->len is a u16 while sizeof() yields size_t, the usual arithmetic conversions promote the subtraction to size_t; when the received frame is shorter than the fixed prefix the result underflows and wraps to a very large unsigned value, which is then truncated when assigned to the u16 length parameter of libipw_parse_info_param(). The parser consequently walks information elements far past the end of the received buffer. Critically, both the ipw2100 and ipw2200 management receive paths only validate that the frame carries the generic 24-byte three-address 802.11 management header before calling this function, so frames between 24 and 29 bytes in length reach the vulnerable arithmetic. This is a classic integer-underflow leading to out-of-bounds read (the CWE-191/CWE-125 family); the upstream report assigns no explicit CWE, and the fix is to reject too-short frames before any fixed field is touched. The finding came from an AI-assisted review of length arithmetic in management frame parsers and was reproduced with a KUnit test case under Generic KASAN on arm64 under QEMU, though it was not validated on real hardware.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Adjacent wireless range only (AV:A), no auth or interaction to receive the frame (PR:N/UI:N); out-of-bounds read crashes the kernel (A:H) with partial memory leak (C:L) and no integrity impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
4DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
wifi: libipw: reject too-short association responses
libipw_handle_assoc_resp() reads the capability, status and aid fields of the 30-byte association response prefix and then computes the information element length as
stats->len - sizeof(*frame)
stats->len is a u16 and sizeof() has type size_t, so the subtraction is evaluated as size_t and wraps instead of going negative. Truncating that to the u16 length parameter of libipw_parse_info_param() turns a frame shorter than the fixed fields into a length near 64 KiB, and the parser then reads past the receive buffer.
Both the ipw2100 and ipw2200 management receive paths reach this function having established only that the frame carries the generic 24-byte three-address header.
Reject the frame before any fixed field is touched.
Found by an AI-assisted review of length arithmetic in management frame parsers. Verified with a KUnit case under Generic KASAN on arm64 under QEMU; I do not have the hardware, so it is not tested on a real device.
Executive ViewAI
A high-severity out-of-bounds read in the Linux kernel's legacy libipw 802.11 management-frame parser can crash systems that use obsolete Intel PRO/Wireless 2100 or 2200BG wireless adapters, creating a denial-of-service risk for organizations still running that hardware. A vendor patch is available per the advisory, no public exploit code has been identified at the time of analysis, and exposure is limited to environments with the legacy ipw2100 or ipw2200 driver stack in active use. Leadership should confirm whether any business-critical, remote, or edge systems still rely on these obsolete adapters.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB