OpenBSD TKIP MIC inverted window: RDoS (CVE-2026-50101)

OpenBSD Inverted TKIP MIC Failure Countermeasure Condition (CVE-2026-50101) Vulnerability Overview The 60-second window determination logic in was inverted: when the interval between two MIC failures is ≤ 60 seconds, the branch that should trigger countermeasures instead directly executes without performing them; the countermeasure path is entered only when the interval is > 60 seconds. This causes failures within the 60-second window to be ignored, with countermeasures triggered only outside the window, which is contrary to the requirements of IEEE 802.11-2012 §11.4.2.4 and the code comments. Scope of Impact Product: OpenBSD (OpenBSD-current, versions prior to 2026-07-15) Affected Configurations: Configurations with WPA1/TKIP enabled Reachability: Both entry points are reachable without authentication from received frames—the decryption path and the EAPOL path ; an attacker only needs to be within the RF range of the interface to trigger it. Impacts: - If an attacker sends one malformed TKIP frame and waits more than 60 seconds before sending a second one, countermeasures are triggered: on the AP, all TKIP clients are disconnected and reassociated (up to 90 seconds), resulting in a repeatable remote denial of service (RDoS). - In a Beck-Towsley-style key cracking attempt, MIC failures occur within the 60-second window; the inverted logic causes these failures to be discarded, rendering the key cracking mechanism ineffective. Scope Limitation: TKIP is disabled by default in OpenBSD; only WPA/TKIP deployments are affected. Fix Upgrade to the kernel containing commit , which changes the comparison condition from to : After the fix, when is true (i.e., the time since the last failure is ≥ 60 seconds), countermeasures are triggered, complying with the standard. Timeline 2026-06-18 — Reported to OpenBSD 2026-07-15 — Fixed in ( rev 1.34) 2026-08-06 — Public disclosure

Goal Reached Thanks to every supporter — we hit 100%!

OpenBSD TKIP MIC inverted window: RDoS (CVE-2026-50101)