Bug 2536402 (CVE-2026-93064)

Summary:	CVE-2026-93064 kernel: wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the `iwlwifi` driver of the Linux kernel. An off-by-one error in the `iwl_mvm_frob_txf_key_iter()` function, responsible for sanitizing transmit (TXF) keys, incorrectly calculates the memory clear operation's starting point. This error results in one byte before the intended key being cleared, while the final byte of the key remains unsanitized. This could potentially lead to information disclosure or compromise of cryptographic keys.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-17 17:44:27 UTC

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser

iwl_mvm_frob_txf_key_iter() tracks the last matched byte position
in loop variable 'i'. When a full key match is found (match ==
keylen), 'i' points at the last byte of the matched key. The
memset start offset should therefore be i + 1 - keylen, not
i - keylen; the current code zeroes one byte before the match
and leaves the final key byte un-sanitised.

Comment 1 gkamathe 2026-09-19 21:38:50 UTC

Upstream advisory:
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93064.mbox