Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-98348

wifi: libipw: reject too-short association responses

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, and 2 more
None on Exploit-DB, Metasploit or GitHub

Summary

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short association responses libipw_handle_assoc_resp() reads the capability, status and aid fields of the 30-byte association response prefix and then computes the information element length as stats->len - sizeof(*frame) stats->len is a u16 and sizeof() has type size_t, so the subtraction is evaluated as size_t and wraps instead of going negative. Truncating that to the u16 length parameter of libipw_parse_info_param() turns a frame shorter than the fixed fields into a length near 64 KiB, and the parser then reads past the receive buffer. Both the ipw2100 and ipw2200 management receive paths reach this function having established only that the frame carries the generic 24-byte three-address header. Reject the frame before any fixed field is touched. Found by an AI-assisted review of length arithmetic in management frame parsers. Verified with a KUnit case under Generic KASAN on arm64 under QEMU; I do not have the hardware, so it is not tested on a real device.

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • Linux Linux

    From 9e8571affd1c54b9638b4ff9844e47aae07310f6 · fixed in 766268b429ae26d8ca599031fa962b0fe4673120; From 9e8571affd1c54b9638b4ff9844e47aae07310f6 · fixed in d70bdb84cf1782039384c1ffa7a18b0303c286a7; From 9e8571affd1c54b9638b4ff9844e47aae07310f6 · fixed in 400b89217058fac672134a0d4092c8493dadb8ad; From 9e8571affd1c54b9638b4ff9844e47aae07310f6 · fixed in 46aa75291056b6dc5faaf956dffdb3e9662477b0; From 9e8571affd1c54b9638b4ff9844e47aae07310f6 · fixed in e3025ecdb2057f866c09e059fc1466e81d6f243e; From 9e8571affd1c54b9638b4ff9844e47aae07310f6 · fixed in 14cb425ba1f3a5d849e3bbc3d02d84e0ae195dbb; From 9e8571affd1c54b9638b4ff9844e47aae07310f6 · fixed in af1b69be19c34e28c0ae54bee954b58cd076969a; From 9e8571affd1c54b9638b4ff9844e47aae07310f6 · fixed in adb7118b7d2cfd7e8213c17d7d2829f353017754

  • Linux Linux

    2.6.15

  • KernelLinux

    From 2.6.15 · fixed in 5.10.271; From 5.11.0 · fixed in 5.15.222; From 5.16.0 · fixed in 6.1.189; From 6.2.0 · fixed in 6.6.158; From 6.7.0 · fixed in 6.12.112; From 6.13.0 · fixed in 6.18.54; From 6.19.0 · fixed in 7.2.8

References 8

git.kernel.org