CVE-2026-93064

What it actually does

Off-by-one error in iwl_mvm_frob_txf_key_iter() causes memset to start one byte too early, zeroing memory before the matched TXF key instead of sanitizing its final byte and leaving residual key material in memory.

Why it matters to the business

Cryptographic key bytes may remain exposed in kernel memory on affected wireless hardware, raising the chance of key leakage that could compromise encrypted network traffic.

How an attack unfolds

An attacker triggers TXF key handling in the iwlwifi driver then inspects or dumps the relevant kernel memory region to recover the unsanitized final key byte, which can be combined with other data to weaken encryption.

How to fix it

Apply the upstream kernel patch that corrects the memset offset from i - keylen to i + 1 - keylen in the TXF key sanitiser function.

How to confirm the fix worked

Inspect the iwl_mvm_frob_txf_key_iter() implementation to verify the memset start offset calculation now correctly covers the entire matched key length.

Typical attack path

1. Locate a system running a vulnerable iwlwifi driver version
2. Cause the driver to perform TXF key matching operations
3. Obtain access to kernel memory containing the partially sanitized key
4. Extract the leftover key byte to aid traffic decryption or further attacks

How to detect it

Search kernel memory dumps, debug logs, or crash reports generated after TXF key operations for patterns indicating an unsanitized final key byte.

What your security team should do

• Prioritize kernel updates containing this fix on all systems using Intel wireless hardware
• Review wireless driver configurations to minimize unnecessary key handling exposure
• Include memory sanitization checks in future wireless driver audits