CVE-2026-93799

A flaw was found in the Linux kernel's iwlwifi wireless driver. When handling Block Ack (BA) window status notifications, the driver fails to validate the station identifier received from the firmware before using it as an array index. A compromised or crafted firmware notification with an invalid station identifier can trigger an out-of-bounds memory read, leading to a system crash and Denial of Service (DoS).

A moderate severity flaw was found in the Linux kernel's Intel wireless (iwlwifi) driver, affecting the kernel component in Red Hat Enterprise Linux 8, 9, and 10, RHIVOS 2, and Red Hat OpenShift 4 and 5. When the driver handles a Block Ack (BA) window status notification from the Wi-Fi firmware, it extracts a 5-bit station identifier (sta_id) and uses it to index the fw_id_to_mac_id[] array without bounds validation. A malformed or crafted firmware notification carrying an out-of-range sta_id causes an out-of-bounds read in drivers/net/wireless/intel/iwlwifi/mvm/rx.c, which can crash the kernel and result in a denial of service; no confidentiality or integrity impact has been demonstrated. Red Hat Enterprise Linux 6 and 7 Extended Lifecycle Support are not affected because the vulnerable code was introduced upstream in Linux kernel version 4.6, which postdates the kernels shipped in those releases. Red Hat assesses this flaw as Moderate impact (CVSS 3.1: 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H): the malformed notification originates from the system's own Wi-Fi firmware, and the consequence is limited to availability. This differs from the upstream CVE.org score of 8.8, which assumes an adjacent-network attacker and high confidentiality and integrity impact that the flaw evidence does not support. Because of the Moderate, denial-of-service-only rating, the fix for the affected products is deferred to a future planned update; the residual risk is a potential kernel crash on systems using affected Intel wireless hardware.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.