CVE-2026-93805

A flaw was found in the Linux kernel's cfg80211 wireless subsystem. The kernel fails to properly validate the length of wireless management frames before accessing subtype-specific data fields. An attacker within wireless range could exploit this flaw by transmitting malformed, truncated management frames, causing an out-of-bounds read. This can result in a system crash, causing a Denial of Service (DoS), or potentially lead to the exposure of sensitive kernel memory.

A moderate-impact out-of-bounds read flaw was found in the cfg80211 wireless subsystem of the Linux kernel, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux, Red Hat In-Vehicle OS, and the RHEL CoreOS images used by OpenShift Container Platform nodes (the RHEL 6 ELS stream is out of support scope). The cfg80211 MLME management-frame handlers only required frames to be at least 2 bytes long before dispatching them to subtype handlers that read subtype-specific fixed fields, such as the 2-byte deauthentication reason code, without validating the minimum length required by the frame subtype. An attacker within wireless radio range could transmit a crafted, truncated 802.11 management frame that an affected driver (mwifiex is a concrete in-tree example) passes to cfg80211, causing the kernel to read past the end of the frame buffer. This can crash the kernel and cause a denial of service. Although the flaw can be triggered by a nearby wireless attacker, Red Hat rates the impact as Moderate because the out-of-bounds access is limited to fixed reason/status code fields and no information disclosure, memory corruption, or privilege escalation path has been demonstrated. Fixes for the affected product streams are currently deferred given this Moderate, availability-only impact; the residual risk of deferral is that an attacker within wireless range of a system using an affected wireless driver could trigger a kernel crash (denial of service) by sending malformed management frames.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.