CVE-2026-93791

A flaw was found in the Linux kernel's iwlwifi wireless driver. This vulnerability can lead to a Denial of Service (DoS) or kernel memory corruption due to an out-of-bounds memory access. When handling block acknowledgment notifications, the driver directly uses a traffic identifier (TID) provided by the device firmware as an array index without bounds validation. A compromised or malicious Wi-Fi firmware could send an invalid identifier, causing an out-of-bounds read or write that crashes the system.

A moderate out-of-bounds access flaw was found in the Linux kernel Intel Wi-Fi (iwlwifi) driver. When handling block acknowledgment notifications, the driver uses a traffic identifier (TID) value supplied by the device firmware directly as an index into the tid_data[] array without validating it against IWL_MAX_TID_COUNT. A compromised or malicious Wi-Fi firmware could supply an out-of-range TID, causing an out-of-bounds read or write in kernel memory that can crash the kernel (denial of service) or corrupt kernel memory. This flaw is rated Moderate by Red Hat with a CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because the directly supported trigger requires the Wi-Fi firmware to be compromised or replaced, which normally requires prior privileged control of the system or its firmware; a practical remote attack path is not established by the upstream fix.

The kernel and kernel-rt packages in Red Hat Enterprise Linux 8, 9, and 10, the kernel and kernel-ivos-qualcomm components of Red Hat In-Vehicle OS 2, and OpenShift Container Platform 4 and 5 (through their RHEL CoreOS 8 and 9 kernels) are affected. Red Hat Enterprise Linux 6 and 7 Extended Life Cycle Support are not affected because the vulnerable code is not present in those kernels.

Fixes for the affected products are currently deferred. Because exploiting this flaw requires an already-compromised or malicious Wi-Fi firmware, which implies substantial prior control over the system, and the direct consequence is a denial of service, the fix is planned for a future update rather than an immediate release. The residual risk is a kernel crash or kernel memory corruption, limited to systems whose Wi-Fi firmware is already under attacker control.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.