SB2026092582 - Out-of-bounds write in Linux kernel iwlwifi mvm driver

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds write (CVE-ID: CVE-2026-93790)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to write outside the bounds of an array.

The vulnerability exists due to improper array index validation in the iwl_mvm_rx_ba_notif handler when processing compressed block acknowledgment notifications. A local user can trigger processing of a compressed block acknowledgment notification containing an invalid TID to write outside the bounds of an array.

Multi-TID block acknowledgment is not generally in use.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/94d3982806c7f194b23484befde12934dda23064
• https://git.kernel.org/stable/c/c48b741277b01b2c3b4ecccedc72fc575b71dc04
• https://git.kernel.org/stable/c/e8ac5e91b1296f65c3d119fac3fa917ff458f811