CVE-2026-93064

A flaw was found in the iwlwifi driver of the Linux kernel. An off-by-one error in the iwl_mvm_frob_txf_key_iter() function, responsible for sanitizing transmit (TXF) keys, incorrectly calculates the memory clear operation's starting point. This error results in one byte before the intended key being cleared, while the final byte of the key remains unsanitized. This could potentially lead to information disclosure or compromise of cryptographic keys.

This vulnerability is rated as Moderate impact for Red Hat because exploitation requires a system equipped with physical Intel Wi-Fi hardware, limiting the exposure primarily to client workstations or mobile devices. In typical Red Hat Enterprise Linux server, container, and cloud environments, wireless networking hardware is not present, substantially reducing overall risk. Although improper key sanitization can potentially expose sensitive cryptographic material, an attacker requires local access or the presence of an active Intel wireless interface to leverage the flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.