EUVD-2026-93334
GHSA-pp5x-p5cv-w76c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker within Wi-Fi range
-
DeliveryBroadcast crafted short beacon/probe response
-
ExploitTrigger u16/size_t length underflow in libipw_network_init
-
ExecutionOut-of-bounds read in IE parser
-
ImpactKernel crash or adjacent memory disclosure
Vulnerability Assessment
| Exploitation Conditions | The target must use the ipw2100 or ipw2200 wireless driver (legacy Intel PRO/Wireless 2100/2200BG adapters) and be processing received 802.11 management frames (scanning or associating), because those receive paths validate only the 24-byte three-address header while libipw_process_probe_response/libipw_network_init assume the full 36-byte beacon/probe-response prefix. The attacker must be within wireless (adjacent-network) range to inject the malformed short frame; no authentication, credentials, or user interaction is required. Exploitation is strictly LIMITED by hardware: systems using any other (modern) Wi-Fi driver are unaffected, which sharply narrows the realistic attack surface despite the unauthenticated nature of the flaw. |
| Impact | Signals point consistently to a low-to-moderate real-world priority despite the 7.1 CVSS. The CVSS vector (AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) describes an adjacent, low-complexity, unauthenticated flaw whose dominant impact is availability (A:H, kernel out-of-bounds read likely crashing the host) with only low confidentiality exposure (C:L) and no integrity impact. EPSS is just 0.17% (6th percentile) and the CVE is NOT in CISA KEV, with no public exploit code referenced - so there is no evidence of active or imminent exploitation. The most important contextual signal is that the vulnerable path lives only in the legacy ipw2100/ipw2200 Wi-Fi drivers (Intel PRO/Wireless 2100/2200BG, circa 2003-2006 hardware); the CPE strings (cpe:2.3:a:linux:linux) make the product look ubiquitous, but the actual attack surface is confined to systems still running that obsolete hardware. A notable caveat: the reporter explicitly states this was found via AI-assisted review and verified only with a KUnit/KASAN test under QEMU, NOT on real hardware - so real-device triggerability is inferred, not confirmed. Bottom line: a legitimately-fixed memory-safety bug, but a low operational priority outside the narrow population of machines using these drivers. |
| Exploit ScenarioDerived | An attacker within Wi-Fi range of a host using the ipw2100 or ipw2200 driver broadcasts a malformed beacon or probe-response frame shorter than the expected 36-byte fixed prefix. The driver's length subtraction underflows (u16/size_t wrap) to ~65524, causing the information-element parser to read almost 64 KiB past the receive buffer, crashing the kernel and potentially leaking adjacent memory. No public exploit is identified at time of analysis; triggerability is verified only in a QEMU/KUnit harness, not on physical hardware. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
An out-of-bounds read in the Linux kernel's legacy libipw 802.11 stack allows an unauthenticated attacker within wireless range to make affected systems walk roughly 64 KiB past the end of a received management frame buffer. Only machines using the legacy Intel PRO/Wireless ipw2100 or ipw2200 drivers are exposed, because those receive paths validate just the generic 24-byte three-address management header while libipw_process_probe_response() and libipw_network_init() assume the full 36-byte beacon/probe-response prefix; the length arithmetic then underflows and is truncated to 65524. The resulting flaw yields limited information disclosure (C:L) and a high availability impact via kernel crash (A:H) against adjacent-network attackers, though it is sharply constrained by the obsolete hardware requirement. Risk signals are low: EPSS is only 0.17% (6th percentile), there is no CISA KEV listing, and no public exploit has been identified at time of analysis.
RemediationAI
Apply the vendor-released kernel patch: upgrade to 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 or 7.3-rc4 as appropriate for your branch, or cherry-pick the upstream fix at https://git.kernel.org/stable/c/cee6f141b3bebe62eb0363fd147acb52023935f0 and its sibling stable commits (23afeb5d2bdfd34c8a0a661876291a4fa9978293, 89959ff00a978f3172726d3d5f861ee6f1aae26d, 14ae269c1306053ddf1ccf37c4bd66e085a652d1, ff756e6647722b7d225d882f7bdb186d8eee318e, 2c87bbc00dc93149d1dc4f803ad92d92e4ef3758, 19959fb60228f6dccc40d55507f8b1a751c2dc89, 5ce5721e8cbe3e80db8f43851cc2a2a92485ef4b), which restores rejection of too-short beacon and probe responses before any fixed field is parsed; this is the only complete fix and requires a kernel update plus reboot. Where patching is not immediately possible, the most effective compensating control is to stop loading the vulnerable drivers: blacklist ipw2100 and ipw2200 via a modprobe.d entry (or rfkill the adapter), accepting that this disables Wi-Fi on machines that depend on those legacy Intel PRO/Wireless cards. The residual risk is intrinsically narrow because exploitation requires an adjacent-network attacker with RF proximity and the target to be actively scanning or associating, so isolating affected hosts onto trusted, physically controlled wireless environments and detaching them from untrusted RF spaces reduces exposure during the patch window, at the cost of restricted mobility. Note that no public exploit has been identified at time of analysis, so urgent out-of-band action is not warranted for the general fleet, but hosts with the legacy hardware should be prioritized for the kernel upgrade or module removal.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
libipw is the shared 802.11 helper library used by the legacy Intel PRO/Wireless ipw2100 and ipw2200 drivers. Management-frame receive paths in those drivers only guarantee that a frame carries the generic 24-byte three-address header before handing it to libipw_process_probe_response(), which calls libipw_network_init() assuming the full 36-byte beacon/probe-response fixed prefix is present. libipw_network_init() derives the information-element length as stats->len - sizeof(*beacon); stats->len is a u16 while sizeof() is size_t, so the subtraction is performed in size_t and wraps instead of going negative. When that wrapped value is truncated back to the u16 length parameter of libipw_parse_info_param(), a 24-byte beacon yields 65524, causing the parser to traverse the receive buffer as if it contained nearly 64 KiB of information elements and read past the allocation. The root-cause class is an integer underflow feeding an out-of-bounds read (CWE-191/CWE-125), although no CWE was formally assigned in the ingested data. The bug was found by an AI-assisted review of length arithmetic in management-frame parsers and verified with a KUnit case under Generic KASAN on arm64 under QEMU; the reporter explicitly notes it was not tested on real hardware. The independent assessment rates this CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H, meaning an unauthenticated adjacent attacker with no user interaction can reach it, but the realistic surface is limited to systems running the legacy ipw2100/ipw2200 drivers rather than modern Wi-Fi drivers.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Adjacent Wi-Fi injection (AV:A), no auth or interaction (PR:N/UI:N); dominant impact is a kernel OOB-read crash (A:H) with limited memory disclosure (C:L) and no integrity effect.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
4DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
wifi: libipw: reject too-short beacon and probe responses
libipw_process_probe_response() and the libipw_network_init() call it makes assume the frame contains the full 36-byte beacon and probe response prefix, but the ipw2100 and ipw2200 receive paths only establish that a management frame carries the generic 24-byte three-address header.
libipw_network_init() then computes the information element length as
stats->len - sizeof(*beacon)
stats->len is a u16 and sizeof() has type size_t, so the subtraction is evaluated as size_t and wraps instead of going negative. Truncating that to the u16 length parameter of libipw_parse_info_param() yields 65524 for a 24-byte beacon, and the parser then walks the receive buffer as if it held almost 64 KiB of information elements, reading past the allocation.
Reject the frame before any fixed field is touched.
Found by an AI-assisted review of length arithmetic in management frame parsers. Verified with a KUnit case under Generic KASAN on arm64 under QEMU; I do not have the hardware, so it is not tested on a real device.
Executive ViewAI
The Linux kernel's legacy libipw 802.11 stack, used by obsolete Intel PRO/Wireless ipw2100 and ipw2200 drivers, contains an out-of-bounds read vulnerability that can be triggered by an attacker within wireless range, leading to limited information disclosure and potential system crashes. Organizations still operating systems with these legacy wireless drivers are affected, though the risk is constrained by the rarity of such hardware and the low likelihood of exploitation. Leadership should prioritize identifying and patching any remaining systems to prevent availability disruptions, while recognizing that overall business impact is low due to the obsolete nature of the affected components.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB