{"id":28599,"date":"2026-09-25T04:31:27","date_gmt":"2026-09-24T20:31:27","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-93784"},"modified":"2026-09-25T04:31:27","modified_gmt":"2026-09-24T20:31:27","slug":"cve-2026-93784","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-93784","title":{"rendered":"CVE-2026-93784 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: valid"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie()<\/p>\n<p>The KASAN allocation trace shows that a malformed IE buffer is<br \/>\nstored via SIOCSIWGENIE (cfg80211_wext_siwgenie()) without any<br \/>\nvalidation. The crash trace shows that a subsequent SIOCSIWESSID<br \/>\ntriggers a connection attempt which calls cfg80211_sme_get_conn_ies()<br \/>\nto process the stored IE buffer, causing:<\/p>\n<p> &#8211; An out-of-bounds read in skip_ie() which reads ies[pos+1]<br \/>\n   (the length byte) past the end of the 1-byte buffer.<\/p>\n<p> &#8211; An integer underflow in the memcpy size argument when offs<br \/>\n   returned by ieee80211_ie_split() exceeds ies_len, causing<br \/>\n   unsigned subtraction to wrap to SIZE_MAX and triggering a<br \/>\n   fortify panic.<\/p>\n<p>Fix this by validating the IE buffer in cfg80211_wext_siwgenie()<br \/>\nbefore storing it.<\/p>\n<p>[drop unnecessary ie_len check, update commit message]<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie()<\/p>\n<p>The KASAN allocation trace shows that a malformed IE buffer is<br \/>\nstored via<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28599","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28599","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28599"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28599"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28599"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}