Skip to main content

Linux Kernel EUVDEUVD-2026-86177

| CVE-2026-93790 HIGH
2026-09-24 Linux GHSA-rh32-7cxx-qxq4
Buffer Overflow Linux Red Hat Suse
8.8
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Position rogue AP adjacent to victim
  2. Delivery
    Establish association with iwlwifi client
  3. Exploit
    Induce multi-TID blockack session
  4. Execution
    Send crafted BA notification
  5. Persist
    Trigger out-of-bounds tid_data write
  6. Impact
    Minor rate-control state corruption

Vulnerability Assessment

Exploitation Conditions

Exploitation requires adjacent (Wi-Fi radio-range) access to a host using the Intel iwlwifi mvm driver AND an active multi-TID blockack scenario so the TFD loop counter 'i' differs from the intended TID. This condition is NOT met in practice: the description states multi-TID blockack is not in use, meaning 'i' is always 0 and the mis-indexed access stays in-bounds, so no out-of-bounds write actually occurs on unpatched systems. Even in a contrived triggering case, the only value written is lq_color, limiting impact to minor rate-control state corruption rather than code execution or data disclosure.
Impact

The input CVSS 3.1 score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) dramatically overstates real-world risk and contradicts the vulnerability description itself. The commit text explicitly states that because multi-TID blockack is not in use, the loop counter 'i' was always 0, so the mis-indexed write into mvmsta->tid_data never actually went out of bounds and 'no harm was done' - this is a latent, defensive-hardening fix rather than a live memory-corruption bug. The written value is only lq_color (a rate-control coloring byte), giving at most minor state corruption, not the Confidentiality:High/Integrity:High/Availability:High the score implies. EPSS is not provided, there is no CISA KEV listing, and no public exploit exists, all consistent with a low-priority hardening patch. This is a clear case of a high-CVSS-but-low-real-risk kernel commit auto-scored from an OOB-write template. CONFLICT TO NOTE: the description's own statement that the OOB never triggers directly contradicts the C:H/I:H/A:H impact metrics - treat the 8.8 as unreliable and prioritize accordingly (low).
Exploit ScenarioDerived

An attacker operating a rogue or compromised Wi-Fi access point adjacent to a victim running the Intel iwlwifi driver would need to induce multi-TID blockack sessions and craft BlockAck notifications so the TFD loop counter diverges from the intended TID, causing lq_color to land in an unintended tid_data slot. In practice this path is unreachable on current stacks because multi-TID blockack is not used (the counter is always 0), so no working attack is realistic and no public exploit or POC exists.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 25, 2026

Out-of-bounds tid_data array access in the Linux kernel's iwlwifi mvm driver (CVE-2026-93790) is a theoretical flaw that writes the lq_color value into an unrelated tid_data slot, but it is not practically triggerable because multi-TID blockack is not in use, meaning the TFD loop counter 'i' is always 0 and the write remains in-bounds on unpatched systems. The affected component is the Intel iwlwifi mvm Wi-Fi driver in Linux kernel versions prior to 6.18.53, 6.12.111, and 7.2. An attacker within Wi-Fi radio range (adjacent, unauthenticated per the assessed CVSS vector) would need a contrived multi-TID blockack scenario to cause minor rate-control state corruption; no public exploit code exists and there is no evidence of active exploitation, so real-world risk is low.

RemediationAI

Apply the vendor-released patch by upgrading to Linux kernel 6.18.53, 6.12.111, or 7.2 (or later). The patch adds an out-of-bounds check before accessing the tid_data array. Because the vulnerability is not practically exploitable-multi-TID blockack is not in use, so no out-of-bounds write occurs on unpatched systems-the immediate risk is low, but patching is still recommended as part of regular maintenance. No specific workarounds are necessary, but if patching is delayed, restricting physical and radio-range access to affected systems can reduce exposure. Refer to the git.kernel.org stable commits for the exact fix: https://git.kernel.org/stable/c/c48b741277b01b2c3b4ecccedc72fc575b71dc04, https://git.kernel.org/stable/c/e8ac5e91b1296f65c3d119fac3fa917ff458f811, and https://git.kernel.org/stable/c/94d3982806c7f194b23484befde12934dda23064. Also see the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-93790.

Affected VersionsENISA

Linux 0 <6.18.53
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <c48b741277b01b2c3b4ecccedc72fc575b71dc04
Linux patch: 7.2
Linux patch: 6.18.53
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <e8ac5e91b1296f65c3d119fac3fa917ff458f811
Linux 0 <6.12.111
Linux patch: 6.12.111
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <94d3982806c7f194b23484befde12934dda23064

Affected Packages

euvd linux fix: 6.12.111, 6.18.53

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability resides in the Linux kernel's iwlwifi mvm driver, which supports Intel Wi-Fi adapters using the MVM firmware architecture. In the block acknowledgment (BA) notification handler, the mvmsta->tid_data array-normally indexed by the Traffic Identifier (TID), a value from 0 to 7-was mistakenly indexed by the TFD loop counter 'i'. This caused the lq_color (link quality color) value to be written into a tid_data slot unrelated to the BA entry. The root cause is an array index error. However, the driver does not use multi-TID blockack in practice, so 'i' was always 0, meaning the mis-indexed access stayed within bounds and no out-of-bounds write actually occurred. The fix adds an explicit out-of-bounds check before accessing the array. The CPE identifier cpe:2.3:a:linux:linux confirms the affected product is the Linux kernel. The independent assessment assigns CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L, indicating that the original 8.8 score dramatically overstates impact; exploitation requires adjacent access and a non-existent multi-TID blockack condition, and even then only minor rate-control state corruption is possible.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 8.8 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 4.2 MEDIUM

Adjacent Wi-Fi vector (AV:A); AC:H because it needs an unused multi-TID blockack path so 'i'≠0; no auth (PR:N); only a rate-control byte is mis-written, so C:N and at most I:L/A:L.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
4.0 AV:A/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
SUSE 5.1 MEDIUM
AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.5 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Sep 25, 2026 - 05:23 NVD
8.8 (HIGH)
Patch available
Sep 24, 2026 - 17:03 EUVD
CVE Published
Sep 24, 2026 - 16:02 cve.org
UNKNOWN (no severity yet)
CVE Published
Sep 24, 2026 - 16:02 cve.org
HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif

mvmsta->tid_data was indexed by the TFD loop counter 'i' instead of the actual TID value 'tid'. This writes lq_color into a random tid_data slot unrelated to the BA entry. Since multi-TID blockack is not really in use, 'i' was always 0 and no harm was done. Add a out-of-bound check before accessing the array.

Executive ViewAI

Why It Matters

Organizations running the Intel iwlwifi mvm Wi-Fi driver on affected Linux kernel versions face a high-severity but practically unreachable out-of-bounds condition that could, only under contrived multi-TID blockack configurations, corrupt rate-control state. Because the prerequisite multi-TID blockack scenario is not normally enabled, no public exploit identified at time of analysis, and there is no evidence of active exploitation, the operational risk to most enterprises is limited. Leadership should prioritize patch verification for Intel Wi-Fi endpoints and Linux-based wireless infrastructure rather than emergency incident response.

Business Impact: Low
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 87% exploitable
Prevalence
High
iwlwifi is the Intel wireless driver shipped in most Linux laptops
Data Quality
4 sources
Confidence: Medium
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Controlled
Automatable· derived
No
Human Impact
Low

Priority Score

44
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-93790 ADVISORY https://vuldb.com/vuln/409505 REF https://git.kernel.org/stable/c/35f991d685feafd27255bd33272512c434e52527 REF https://git.kernel.org/stable/c/94d3982806c7f194b23484befde12934dda23064 REF https://git.kernel.org/stable/c/c48b741277b01b2c3b4ecccedc72fc575b71dc04 REF https://git.kernel.org/stable/c/e8ac5e91b1296f65c3d119fac3fa917ff458f811

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy