Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-93789— wifi: iwlwifi: bound aligned TLV advance in FW parser

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： wifi: iwlwifi: 在固件解析器中对 TLV 对齐后的地址增量进行边界检查 在从固件镜像中消耗字节之前，验证 （即对 TLV 长度按 4 字节对齐）是否不超过解析器剩余的可用长度。 此举可防止因格式错误的 TLV 导致长度下溢（underflow）。

AI Predicted 4.4 Difficulty: Moderate EPSS 0.17% · P6

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 16

VendorProduct Version RangeStatus
Linux Linux dd7a2509b3a79b290730a9c6a784bf03fedabb9a< 61da42fdd21d98ccb8f1ec5224659f3d09202cf4 affected
dd7a2509b3a79b290730a9c6a784bf03fedabb9a< 8c332d45b736d41301b7e07f322785d821265dbc affected
dd7a2509b3a79b290730a9c6a784bf03fedabb9a< ce709fcab5e1d4df6d4ba980736dc5908502a40f affected
dd7a2509b3a79b290730a9c6a784bf03fedabb9a< 4cfadb2e01566bc36d42922fbe18838345087050 affected
dd7a2509b3a79b290730a9c6a784bf03fedabb9a< 528fa9eb14c209533ca26958b76da55e0ce239d8 affected
dd7a2509b3a79b290730a9c6a784bf03fedabb9a< 7aa9097623afb694bc25382a62e14d8e82bf002f affected
dd7a2509b3a79b290730a9c6a784bf03fedabb9a< acad742714bdc70e7fd7f234323807c596828213 affected
2.6.35 affected
… +8 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-93789

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
wifi: iwlwifi: bound aligned TLV advance in FW parser
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: bound aligned TLV advance in FW parser Validate ALIGN(tlv_len, 4) against remaining parser length before consuming bytes from the firmware image. This avoids length underflow on malformed TLVs.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux dd7a2509b3a79b290730a9c6a784bf03fedabb9a ~ 61da42fdd21d98ccb8f1ec5224659f3d09202cf4 -
Linux Linux 2.6.35 -

II. Public POCs for CVE-2026-93789

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-93789

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-93789 (7)

Same Patch Batch · Linux · 2026-09-24 · 234 CVEs total

CVE-2026-93207 9.8 CRITICAL SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry
CVE-2026-97413 9.8 CRITICAL RDMA/rtrs-srv: Fix integer underflow in process_read and process_write
CVE-2026-93228 9.1 CRITICAL svcrdma: Reject Write/Reply chunks with segcount 0
CVE-2026-93793 8.8 HIGH wifi: iwlwifi: mvm: validate TX_CMD response layout
CVE-2026-93799 8.8 HIGH wifi: iwlwifi: mvm: validate sta_id in BA window status notif
CVE-2026-93790 8.8 HIGH wifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif
CVE-2026-97442 8.8 HIGH wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi
CVE-2026-93806 8.8 HIGH wifi: cfg80211: validate assoc response length before status and IE access
CVE-2026-97509 8.8 HIGH thunderbolt: Keep XDomain reference during the lifetime of a service
CVE-2026-97409 8.8 HIGH nvme-fc: Do not cancel requests in io target before it is initialized
CVE-2026-93280 8.8 HIGH greybus: audio: bound the topology section sizes against the fetched size
CVE-2026-93284 8.8 HIGH drm/pagemap: dma-unmap pages before handling migration errors
CVE-2026-97451 8.4 HIGH ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op)
CVE-2026-97452 8.4 HIGH ACPICA: Prevent adding invalid references
CVE-2026-97455 8.4 HIGH ACPICA: Fix use-after-free in acpi_ds_terminate_control_method()
CVE-2026-97450 8.4 HIGH ACPICA: validate handler object type in two places
CVE-2026-93827 8.4 HIGH virtio-fs: avoid double-free on failed queue setup
CVE-2026-97433 8.2 HIGH nvme: validate FDP configuration descriptor sizes
CVE-2026-93224 8.1 HIGH svcrdma: Fix unmatched rn_unregister on failed accept
CVE-2026-93787 8.1 HIGH smb: client: bound dirent name against end of SMB response in cifs_filldir

Showing top 20 of 234 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-93789

No comments yet

Leave a comment