CVE-2026-93784

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie()<br /> <br /> The KASAN allocation trace shows that a malformed IE buffer is<br /> stored via SIOCSIWGENIE (cfg80211_wext_siwgenie()) without any<br /> validation. The crash trace shows that a subsequent SIOCSIWESSID<br /> triggers a connection attempt which calls cfg80211_sme_get_conn_ies()<br /> to process the stored IE buffer, causing:<br /> <br /> - An out-of-bounds read in skip_ie() which reads ies[pos+1]<br /> (the length byte) past the end of the 1-byte buffer.<br /> <br /> - An integer underflow in the memcpy size argument when offs<br /> returned by ieee80211_ie_split() exceeds ies_len, causing<br /> unsigned subtraction to wrap to SIZE_MAX and triggering a<br /> fortify panic.<br /> <br /> Fix this by validating the IE buffer in cfg80211_wext_siwgenie()<br /> before storing it.<br /> <br /> [drop unnecessary ie_len check, update commit message]