wifi: iwlwifi: mei: check SAP message length before reading it
Summary
| CVE | CVE-2026-93063 |
|---|---|
| State | PUBLISHED |
| Assigner | Linux |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-17 17:18:00 UTC |
| Updated | 2026-09-18 18:18:19 UTC |
| Description | In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mei: check SAP message length before reading it Verify the SAP message size is not larger than the local buffer before reading the message to avoid buffer overflow. |
Risk And Classification
Primary CVSS: v3.1 8.4 HIGH from 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.001900000 probability, percentile 0.089950000 (date 2026-09-18)
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | Secondary | 8.4 | HIGH | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | CNA | DECLARED | 8.4 | HIGH | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
CVSS v3.1 Breakdown
Attack Vector
LocalAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Linux | Linux | affected a29e442ee110aafdf7785fac6de44b22d3da43db a4034f1cc8a422cefc519290d8e6cfb7ff773586 git | Not specified |
| CNA | Linux | Linux | affected bcd68b3dbe78b7b0f7b6b55162cf1eff1e7fff9e b90ebae632318dc2e5cd4ac96e454ec50f705579 git | Not specified |
| CNA | Linux | Linux | affected bcd68b3dbe78b7b0f7b6b55162cf1eff1e7fff9e 9c6bea89a16815688a5240dd4a74c922a92fcdc3 git | Not specified |
| CNA | Linux | Linux | affected bcd68b3dbe78b7b0f7b6b55162cf1eff1e7fff9e 242125bbf19a2974d22f3d5025c9c14c0a4aea58 git | Not specified |
| CNA | Linux | Linux | affected bcd68b3dbe78b7b0f7b6b55162cf1eff1e7fff9e f7f770d12e6e928006f89a59291074e5fea82886 git | Not specified |
| CNA | Linux | Linux | affected bcd68b3dbe78b7b0f7b6b55162cf1eff1e7fff9e 7d8cc301bcba233f31b589a45f4c1c97f2bb90d6 git | Not specified |
| CNA | Linux | Linux | affected 9f71cebcac2148e68d0d67f113d0f9aabfcc7a2a git | Not specified |
| CNA | Linux | Linux | affected 6.1.2 6.1.188 semver | Not specified |
| CNA | Linux | Linux | affected 6.0.16 6.1 semver | Not specified |
| CNA | Linux | Linux | affected 6.2 | Not specified |
| CNA | Linux | Linux | unaffected 6.2 semver | Not specified |
| CNA | Linux | Linux | unaffected 6.1.188 6.1.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.6.157 6.6.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.12.110 6.12.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.18.52 6.18.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.2.6 7.2.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.3-rc1 * original_commit_for_fix | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| git.kernel.org/stable/c/b90ebae632318dc2e5cd4ac96e454ec50f705579 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/f7f770d12e6e928006f89a59291074e5fea82886 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/7d8cc301bcba233f31b589a45f4c1c97f2bb90d6 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/9c6bea89a16815688a5240dd4a74c922a92fcdc3 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/242125bbf19a2974d22f3d5025c9c14c0a4aea58 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/a4034f1cc8a422cefc519290d8e6cfb7ff773586 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.