Cloudanix VulnDB

CVE-2026-93065

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A counting error in the Wi-Fi driver can cause the computer to freeze or crash when the wireless hardware reports too many error details.

Exploitation
Other
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Integer type mismatch in loop counter causes wrap-around to zero when firmware-supplied num_pc exceeds 255, resulting in non-terminating loop and potential out-of-bounds read past pc_data buffer.

Why it matters to the business

A system running the affected Wi-Fi driver may become unresponsive or crash when the firmware reports an unusually large error log, leading to loss of wireless connectivity and possible denial of service on affected Linux hosts.

How an attack unfolds

An attacker supplies or emulates firmware that advertises more than 255 program counter entries during error log collection; the u8 counter wraps, the loop fails to terminate, and the kernel either hangs or reads beyond the allocated array.

How to fix it

Apply the upstream kernel patch that changes the loop counter declaration from u8 to u32; rebuild and deploy the updated iwlwifi module or full kernel image.

How to confirm the fix worked

Confirm the source change in iwl_fwrt_dump_error_logs shows count declared as u32 matching num_pc; test by injecting a firmware log with num_pc > 255 and verify the loop terminates without crash or hang.

Typical attack path

  1. Attacker gains ability to influence or replace iwlwifi firmware image or error log contents
  2. Firmware advertises num_pc value greater than 255 during error dump path
  3. Kernel enters iwl_fwrt_dump_error_logs with mismatched u8 counter
  4. Counter wraps, loop condition never satisfied, infinite loop or buffer over-read occurs

How to detect it

Search kernel logs and crash dumps for repeated entries or stalls originating from iwl_fwrt_dump_error_logs; correlate with Wi-Fi firmware error events that contain unusually large program counter counts.

What your security team should do

  • Prioritize patching systems that use Intel Wi-Fi adapters and load the iwlwifi driver
  • Monitor vendor kernel updates for the corrected driver and schedule rollout within normal change windows
  • Review any custom firmware or out-of-tree iwlwifi builds for the same integer type issue

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs The loop counter 'count' was declared as u8 while num_pc is u32. If firmware advertises more than 255 PC entries the counter wraps back to zero and the loop never terminates potentially causing an infinite loop or reading past the allocated pc_data array. Change the declaration to u32 to match num_pc.

Affected packages

Ecosystem Package Introduced Fixed