Bug 2540473 (CVE-2026-93788)

Summary:	CVE-2026-93788 kernel: wifi: iwlwifi: acpi: validate WGDS table revision index
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's iwlwifi wireless driver. When processing Advanced Configuration and Power Interface (ACPI) data, the driver does not properly validate the revision index of the WiFi Global Dynamic SAR (WGDS) table before performing a bit-shift calculation. An invalid revision value reported by the device firmware can trigger an undefined shift operation, potentially resulting in system instability or a Denial of Service (DoS).	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-24 16:57:25 UTC

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: acpi: validate WGDS table revision index

Check tbl_rev bounds before BIT(tbl_rev) to avoid undefined shifts when
firmware reports an invalid revision value.

Comment 1 Mauro Matteo Cascella 2026-09-28 10:23:26 UTC

Upstream advisory:
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93788.mbox