CVE-2026-93806

A flaw was found in the Linux kernel's cfg80211 wireless subsystem. An attacker within Wi-Fi range could cause a Denial of Service (DoS) by sending a truncated association response frame. The wireless component accesses status and information fields before verifying that the received management frame is long enough, causing an out-of-bounds memory read that can crash the system.

A flaw of MODERATE severity was found in the cfg80211 wireless subsystem of the Linux kernel as shipped in Red Hat Enterprise Linux 7, 8, 9, and 10 (kernel and kernel-rt), Red Hat In-Vehicle OS, and the RHEL CoreOS 8 and RHEL CoreOS 9 kernels used by Red Hat OpenShift Container Platform 4 and 5. The cfg80211_rx_assoc_resp() function initializes the status and response information element (IE) fields of cfg80211_connect_resp_params from a received association response management frame before validating that the frame is long enough for those offsets, and the S1G (Sub-1 GHz) association path patches resp_ie only after the unsafe initialization has already run. An attacker within Wi-Fi radio range could send a truncated association response frame, causing an out-of-bounds kernel memory read that can crash the system, resulting in a denial of service. No confidentiality or integrity impact is demonstrated, and Red Hat rates this flaw MODERATE (CVSS 3.1 score 5.5). This differs from the upstream CVE record severity of 8.8 IMPORTANT, which assigns high confidentiality and integrity impacts that are not supported by the technical evidence. Fixes for the affected Red Hat products are currently deferred: the issue is rated MODERATE with impact limited to availability, so the fix will be delivered in a future kernel update rather than an immediate security erratum. Until a fix is delivered, the residual risk is that an attacker within Wi-Fi range can trigger a kernel crash and denial of service on systems whose wireless subsystem processes association responses. Red Hat Enterprise Linux 6 Extended Lifecycle Support is out of support scope, and no fix is planned for it.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.