PT-2026-104887 · Azure Linux · Kernel
Published
2026-09-24
·
Updated
2026-09-24
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: validate IEs in cfg80211 wext siwgenie()
The KASAN allocation trace shows that a malformed IE buffer is
stored via SIOCSIWGENIE (cfg80211 wext siwgenie()) without any
validation. The crash trace shows that a subsequent SIOCSIWESSID
triggers a connection attempt which calls cfg80211 sme get conn ies()
to process the stored IE buffer, causing:
-
An out-of-bounds read in skip ie() which reads ies[pos+1] (the length byte) past the end of the 1-byte buffer.
-
An integer underflow in the memcpy size argument when offs returned by ieee80211 ie split() exceeds ies len, causing unsigned subtraction to wrap to SIZE MAX and triggering a fortify panic.
Fix this by validating the IE buffer in cfg80211 wext siwgenie()
before storing it.
[drop unnecessary ie len check, update commit message]
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Kernel