SB2026092596 - Out-of-bounds read in Linux kernel realtek rtw89 driver
Published: September 25, 2026
Security Bulletin ID
SB2026092596
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Adjecent network
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Out-of-bounds read (CVE-ID: CVE-2026-93281)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to read out-of-bounds memory.
The vulnerability exists due to an out-of-bounds read in rtw89_mac_check_he_obss_narrow_bw_ru_iter() when processing extended capability information with a length of 10 bytes. A remote attacker can provide an extended capability element that is 10 bytes long to read out-of-bounds memory.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/2aba608a86e9b099c9af2ea70b620552dee2b628
- https://git.kernel.org/stable/c/655c4401c18d735dbaf2cc172ff4f626b3a896a0
- https://git.kernel.org/stable/c/bddbd1de765bf6ddc0473ad683910eb3a2a92a43
- https://git.kernel.org/stable/c/eddf53f1edb0cf7f302bd15cdb47cca90948c205
- https://git.kernel.org/stable/c/f132fc01b359a0f7d81fe13d769ea4e7c4baa66e
- https://git.kernel.org/stable/c/f2a01deff7d0d5cc3dcbf2358dac113979303c8e