Out-of-bounds write in Linux kernel - CVE-2026-93790

Vulnerability details

The vulnerability allows a local user to write outside the bounds of an array.

The vulnerability exists due to improper array index validation in the iwl_mvm_rx_ba_notif handler when processing compressed block acknowledgment notifications. A local user can trigger processing of a compressed block acknowledgment notification containing an invalid TID to write outside the bounds of an array.

Multi-TID block acknowledgment is not generally in use.

Affected software

How to mitigate CVE-2026-93790

External References

• https://git.kernel.org/stable/c/94d3982806c7f194b23484befde12934dda23064
• https://git.kernel.org/stable/c/c48b741277b01b2c3b4ecccedc72fc575b71dc04
• https://git.kernel.org/stable/c/e8ac5e91b1296f65c3d119fac3fa917ff458f811

Related Security Bulletins

• Out-of-bounds write in Linux kernel iwlwifi mvm driver