Linux Kernel EUVD-2026-86193

Exploitation requires the attacker to be within 802.11 radio range (adjacent network) and to inject or transmit a crafted, too-short association-response frame - including the S1G variant with its distinct IE offsets - to a Linux client while that client is performing association (e.g. by standing up a rogue AP the victim connects to or by spoofing the AP the victim is associating with). No authentication is required (the malformed frame is parsed on the connect/receive path before higher-layer auth completes), but exploitation is LIMITED to the association window and to the WiFi radio proximity; a target with WiFi disabled, not associating, or not on the vulnerable pre-patch kernel is unaffected. There is no remote-Internet reachability - the vector is strictly over-the-air.

This is a CWE-125 out-of-bounds read in the Linux kernel cfg80211 layer: cfg80211_rx_assoc_resp() populates the status and response-IE fields of cfg80211_connect_resp_params from a received association-response management frame before validating that the frame is long enough to contain those offsets (the bug is aggravated by S1G vs. regular assoc-resp having different IE offsets, with the S1G path only patching resp_ie after the unsafe initializer ran). The NVD/Linux CVSS of 8.8 (AV:A/AC:L/PR:N/UI:N/C:H/I:H/A:H) treats this as full triad compromise, which appears OVERSTATED for a read-only bounds violation - the realistic impact is a bounded kernel/skb memory over-read (small info leak) and, more probably, a kernel panic/DoS when the short frame is dereferenced, so the confidentiality/integrity claims of C:H/I:H are not well supported. Unlike the sibling iwlwifi OOB bugs (e.g. CVE-2026-93799/CVE-2026-93793) which are firmware→host gated and effectively local, this one is genuinely over-the-air: the frame is parsed on the WiFi receive path, so AV:A/PR:N is credible for a rogue AP. No EPSS, KEV, or public POC signal is present, so despite the ubiquity of the affected code there is no evidence of prioritized real-world exploitation; treat this as a patch-on-normal-cadence memory-safety hardening fix rather than an emergency. Key data gap: CWE is listed N/A in the input - it is really CWE-125 - and the impact metrics conflict with the read-only nature of the defect, which should be verified against the kernel commit.

An attacker operating a rogue or spoofed access point within radio range of a target sends a crafted, truncated 802.11 association-response frame (or S1G assoc-resp) to a Linux station that is in the process of associating. cfg80211_rx_assoc_resp() reads the status and IE fields at offsets beyond the short frame, causing an out-of-bounds read that leaks adjacent kernel memory or, more likely, panics the kernel. No public exploit code has been identified at the time of analysis.