CVE-2026-98193 wifi: libipw: reject TKIP frames without a full MIC
A missing check in the Linux kernel WiFi driver allows out-of-bounds reads via short TKIP frames, potentially causing crashes or code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98193?
CVE-2026-98193 is a memory corruption vulnerability in Linux, published on 6 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
wifi: libipw: reject TKIP frames without a full MIC
libipw_michael_mic_verify() assumes that an skb contains an eight-byte Michael MIC. A short TKIP frame makes the unsigned payload length wrap, causing michael_mic() to read past the skb.
Check that the MIC is present before verifying it, and use the existing MICHAEL_MIC_LEN constant for all MIC lengths in the verifier.
Which versions are affected by CVE-2026-98193?
How do I fix CVE-2026-98193?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-98193 being exploited?
There is no known exploitation of CVE-2026-98193 in the wild and no public exploit code.
Sources
Also known as AZL-106161, BELL-CVE-2026-98193, DEBIAN-CVE-2026-98193, GHSA-8rh9-27vf-9cwr, UBUNTU-CVE-2026-98193.