CVE-2026-93789

A flaw was found in the Linux kernel's iwlwifi driver. This vulnerability allows a local user capable of loading custom firmware to cause a Denial of Service (DoS) through a system crash. The issue stems from insufficient bounds checking when parsing aligned Type-Length-Value (TLV) data blocks within firmware images. By supplying a crafted firmware file, an attacker can trigger an integer underflow, leading to out-of-bounds memory reads.

A flaw of moderate severity was found in the Linux kernel's iwlwifi driver as shipped in Red Hat Enterprise Linux, Red Hat In-Vehicle OS, and the RHEL CoreOS images used by OpenShift Container Platform nodes. The iwlwifi firmware parser (drivers/net/wireless/intel/iwlwifi/iwl-drv.c) did not validate the 4-byte-aligned TLV length (ALIGN(tlv_len, 4)) against the remaining length of the firmware image before advancing the parser. A malformed TLV in a crafted firmware file could therefore cause an integer underflow of the remaining-length value, allowing the parser to read beyond the end of the firmware image and potentially crash the kernel, resulting in a local denial of service. Exploitation requires local access and the ability to supply or replace the firmware image loaded by the Intel wireless driver; the flaw is not reachable through normal WiFi traffic processing, which limits practical exposure. Red Hat Enterprise Linux 6 Extended Lifecycle Support is not affected because the vulnerable code is not present in that kernel stream. For the affected products the fix is currently deferred because reliable triggering requires an attacker to already control the firmware image on the system, which is normally administrator-controlled and commonly signature-checked; the residual risk is a local denial of service on systems where an untrusted actor can control the iwlwifi firmware that is loaded. Red Hat rates this flaw Moderate severity (CVSS 5.5), reflecting the local attack vector and the availability-only impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.