CVE-2026-93805

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: validate rx/tx MLME callback frame lengths before access

cfg80211_rx_mlme_mgmt() and cfg80211_tx_mlme_mgmt() call tracepoints

before rejecting frames shorter than the frame-control field. After

that, they only require len >= 2 before dispatching into subtype

handlers that assume their fixed fields are present.

The frames that trip this are not shorter than 2 bytes; they are short

relative to their subtype. mwifiex is a concrete in-tree example on the

length side: mwifiex_process_mgmt_packet() only requires a 4-address

ieee80211_hdr plus the 2-byte firmware length prefix before handing the

frame to cfg80211_rx_mlme_mgmt(). After stripping the length prefix and

removing addr4, pkt_len can be exactly 24: a bare 3-address management

header with no reason-code body. The existing WARN_ON(len < 2) does not

fire on such a frame, and cfg80211_process_deauth() then reads

u.deauth.reason_code as a two-byte acce

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References