PT-2026-104887 · Azure Linux · Kernel
Publicado
2026-09-24
·
Atualizado
2026-09-24
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: validate IEs in cfg80211 wext siwgenie()
The KASAN allocation trace shows that a malformed IE buffer is
stored via SIOCSIWGENIE (cfg80211 wext siwgenie()) without any
validation. The crash trace shows that a subsequent SIOCSIWESSID
triggers a connection attempt which calls cfg80211 sme get conn ies()
to process the stored IE buffer, causing:
-
An out-of-bounds read in skip ie() which reads ies[pos+1] (the length byte) past the end of the 1-byte buffer.
-
An integer underflow in the memcpy size argument when offs returned by ieee80211 ie split() exceeds ies len, causing unsigned subtraction to wrap to SIZE MAX and triggering a fortify panic.
Fix this by validating the IE buffer in cfg80211 wext siwgenie()
before storing it.
[drop unnecessary ie len check, update commit message]
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Kernel