CVE-2026-93793

A flaw was found in the Linux kernel's Intel Wi-Fi driver (iwlwifi). The driver does not properly validate the length and structure of transmission command (TX_CMD) responses received from device firmware before parsing the data. A compromised firmware or malicious wireless device can return a malformed response with an unexpected frame count, triggering an out-of-bounds memory read. This issue may lead to a kernel crash and a Denial of Service (DoS).

A moderate-severity out-of-bounds read flaw was found in the Linux kernel's Intel Wi-Fi driver (iwlwifi). The iwlwifi mvm driver uses the frame_count field of a TX_CMD response from the device firmware to walk the aggregation status entries and read the trailing SCD SSN value, without first validating that the response payload matches the required runtime length. A compromised Wi-Fi firmware, or privileged local control over the wireless device or firmware environment, can supply a malformed TX_CMD response with an unexpected frame count, causing the driver to read beyond the actual response payload; this can crash the kernel and result in a denial of service. The issue is not directly reachable by a remote Wi-Fi peer, because an external peer does not normally control the internal TX_CMD response generated by the firmware. Red Hat therefore rates this flaw Moderate (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), with impact limited to system availability. This differs from the upstream CVEORG rating of Important (8.8, AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), which assumes an adjacent-network attack vector with full impact on confidentiality, integrity, and availability. The vulnerable code is present in Red Hat Enterprise Linux 7, 8, 9, and 10 (kernel and kernel-rt), Red Hat In-Vehicle OS, and OpenShift Container Platform RHEL CoreOS 8 and 9 images. For these affected products the fix is currently deferred because the flaw is rated Moderate severity, so the upstream fix will be addressed in a future scheduled update; the residual risk is a potential kernel crash (denial of service) on systems using affected Intel Wi-Fi hardware. Red Hat Enterprise Linux 6 Extended Lifecycle Support is not affected because the vulnerable code is not present in that stream.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.