CVE-2026-93062

What it actually does

Division by zero in iwl_dbg_tlv_alloc_fragments when num_frags evaluates to zero because required size is not validated before fragment calculation.

Why it matters to the business

May cause kernel crashes or denial of service on Linux systems with Intel wireless hardware, leading to unplanned downtime and reduced system availability.

How an attack unfolds

An attacker supplies or triggers debug TLV data that results in a zero required size, causing num_frags to become zero and triggering a division by zero during allocation.

How to fix it

Apply the upstream kernel commit that adds explicit checks ensuring required size is non-zero and num_frags is validated before use.

How to confirm the fix worked

Inspect the iwlwifi debug TLV code for the added size and num_frags guards; confirm the function no longer allows zero fragment counts.

Typical attack path

1. Gain local access or control over debug TLV input
2. Craft input resulting in required size of zero
3. Invoke iwl_dbg_tlv_alloc_fragments
4. Trigger division by zero and kernel fault

How to detect it

Search kernel logs and crash dumps for division by zero faults or oops messages referencing iwl_dbg_tlv_alloc_fragments.

• iwl_dbg_tlv_alloc_fragments
• division by zero
• num_frags = 0

What your security team should do

• Update to a kernel containing the fix for CVE-2026-93062
• Monitor kernel logs for oops or division-by-zero faults involving iwlwifi
• Disable unnecessary debug TLV interfaces where feasible