CVE-2026-93790

A flaw was found in the Linux kernel's iwlwifi wireless driver. An out-of-bounds memory access vulnerability exists in the Block Acknowledgement (BA) notification handling logic due to improper array indexing and missing bounds validation on traffic identifiers. A nearby attacker within wireless range could exploit this flaw by transmitting specially crafted wireless frames, causing memory corruption that results in a system crash and Denial of Service (DoS).

A moderate-impact out-of-bounds write flaw was found in the Linux kernel's iwlwifi (Intel Wi-Fi) driver, as shipped in the kernel of Red Hat Enterprise Linux, Red Hat In-Vehicle OS, and OpenShift Container Platform. When the iwlwifi MVM driver handles a Block Acknowledgement (BA) notification from the wireless firmware, the mvmsta->tid_data array is indexed with the TFD loop counter instead of the actual traffic identifier (TID) and lacks a bounds check, so the link-quality color value can be written into an unrelated or out-of-bounds tid_data slot. An attacker within wireless range of a system using an affected Intel Wi-Fi adapter could transmit specially crafted wireless frames to trigger this out-of-bounds access, causing memory corruption that can crash the kernel and result in denial of service. Upstream noted that because multi-TID block acknowledgment is not really in use, the loop counter was always 0 and no harm was done, so the flaw is unlikely to be exploited in practice; this supports Red Hat's moderate severity rating, which is lower than the higher severity assigned in the upstream CVE record. The Red Hat Enterprise Linux 6 and 7 kernels do not contain the vulnerable code and are not affected. Because of the moderate impact and low practical exploitability, fixes for the affected streams are deferred to future planned updates; the residual risk is a potential kernel panic and denial of service on systems with affected Intel Wi-Fi hardware that are within wireless range of an attacker.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.