CVE-2026-93784 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux-based systems should assess exposure and prioritize patching. Affected operators must review cfg80211_wext_siwgenie() function deployments. Platform and vulnerability-management teams need to validate IE buffer validation. Security teams should monitor for potential denial of service attempts.

Why it matters

A vulnerability in the Linux kernel's cfg80211_wext_siwgenie() function allows for an out-of-bounds read and integer underflow when processing a malformed IE buffer. This issue can be triggered by a local attacker through the SIOCSIWGENIE and SIOCSIWESSID ioctls, potentially leading to a denial of service. Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux-based systems should assess exposure and prioritize patching.

• Denial of service through system crash or instability
• Potential for local privilege escalation or unauthorized access
• Need for patching and validation of IE buffers in cfg80211_wext_siwgenie()

Technical summary

The vulnerability is caused by the lack of validation of the IE buffer in cfg80211_wext_siwgenie(). The KASAN allocation trace shows that a malformed IE buffer is stored via SIOCSIWGENIE without any validation. The crash trace shows that a subsequent SIOCSIWESSID triggers a connection attempt which calls cfg80211_sme_get_conn_ies() to process the stored IE buffer, causing an out-of-bounds read and integer underflow.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided patches to validate IE buffers in cfg80211_wext_siwgenie()
• Restrict access to SIOCSIWGENIE and SIOCSIWESSID ioctls to trusted users
• Monitor system logs for potential denial of service attempts
• Perform thorough vulnerability assessments to identify potential exposure
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The vulnerability is caused by the lack of validation of the IE buffer in cfg80211_wext_siwgenie(). The KASAN allocation trace shows that a malformed IE buffer is stored via SIOCSIWGENIE without any validation. The crash trace shows that a subsequent SIOCSIWESSID triggers a connection attempt which calls cfg80211_sme_get_conn_ies() to process the stored IE buffer, causing an out-of-bounds read and integer underflow.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.