CVE-2026-98193

In the Linux kernel, the following vulnerability has been resolved:

wifi: libipw: reject TKIP frames without a full MIC

libipw michael mic verify() assumes that an skb contains an eight-byte Michael MIC. A short TKIP frame makes the unsigned payload length wrap, causing michael mic() to read past the skb.

Check that the MIC is present before verifying it, and use the existing MICHAEL MIC LEN constant for all MIC lengths in the verifier.