CVE-2026-93803 wifi: libipw: fix key index receive bound checks
A missing bounds check in the Linux kernel libipw WiFi driver allows out-of-bounds reads, potentially causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-93803?
CVE-2026-93803 is a denial of service vulnerability in Linux, published on 24 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: libipw: fix key index receive bound checks
libipw_rx() reads skb->data[hdrlen + 3] to extract the WEP key index in both the software-decrypt key selection path and the hardware-decrypted IV/ICV strip path. In both places the existing guard only checks skb->len >= hdrlen + 3, which proves bytes up to hdrlen + 2 but not the byte at hdrlen + 3.
Require hdrlen + 4 bytes before reading that item in both paths. This is a local source-boundary check only; it does not change the key index semantics.
Which versions are affected by CVE-2026-93803?
How do I fix CVE-2026-93803?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-93803 being exploited?
There is no known exploitation of CVE-2026-93803 in the wild and no public exploit code.
Sources
Also known as AZL-103811, BELL-CVE-2026-93803, DEBIAN-CVE-2026-93803, GHSA-7f2h-763g-25cr, UBUNTU-CVE-2026-93803.