Out-of-bounds read in Linux kernel - CVE-2026-98193
Published: October 7, 2026
Vulnerability identifier: #VU153827
CSH Severity: Low
CVSS v4: 0 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98193
CWE-ID: CWE-125
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to trigger an out-of-bounds read.
The vulnerability exists due to an unsigned payload length wraparound in libipw_michael_mic_verify() when processing short TKIP frames without a complete eight-byte Michael MIC. A remote attacker can send a short TKIP frame to trigger an out-of-bounds read in michael_mic() beyond the socket buffer.
The TKIP key must be set for the vulnerable verification path to run.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-98193
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.113-1
linux (Debian package) - update to 6.12.113-1