CVE-2026-93807 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems with rsi wifi drivers should be aware of this vulnerability. They should verify and apply kernel updates, restrict access to wifi configuration, and monitor for suspicious wifi activity. Additionally, security teams and vulnerability management teams should review the vulnerability and apply necessary mitigations. Operators of Linux-based systems with rsi

Why it matters

A vulnerability in the Linux kernel's rsi wifi driver could allow an attacker to read past the supplied key buffer when loading keys for non-TKIP ciphers. Defenders should verify and apply kernel updates, restrict access to wifi configuration, and monitor for suspicious wifi activity.

• Verify key loading for rsi wifi driver
• Restrict access to wifi configuration
• Monitor for suspicious wifi activity

Technical summary

The Linux kernel's rsi wifi driver has a vulnerability where it unconditionally copies tx_mic_key and rx_mic_key from data[16] and data[24] without checking the cipher type. This can lead to reading past the supplied key buffer for non-TKIP ciphers like CCMP. The vulnerability has been resolved by only copying the MIC keys for TKIP and rejecting malformed TKIP keys that are shorter than the expected 32-byte layout. Users should update to the latest kernel version to mitigate this vulnerability. The fix involves adding checks for the cipher type before copying the MIC keys.

Defensive priority

Verify and apply kernel updates; restrict access to wifi configuration

Recommended defensive actions

• Verify and apply kernel updates
• Restrict access to wifi configuration
• Monitor for suspicious wifi activity
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

The Linux kernel's rsi wifi driver has a vulnerability where it unconditionally copies tx_mic_key and rx_mic_key from data[16] and data[24] without checking the cipher type. This can lead to reading past the supplied key buffer for non-TKIP ciphers like CCMP.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.