Cloudanix VulnDB

CVE-2026-98193

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in Linux wireless handling can let specially made network frames crash the system or leak small amounts of memory if older encryption settings are still active.

Exploitation
Adjacent Network
Attacker needs
None
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds read in libipw_michael_mic_verify() when a short TKIP frame causes unsigned length wraparound, allowing michael_mic() to access memory past the skb buffer.

Why it matters to the business

Wireless Linux systems using TKIP may experience kernel crashes, denial of service, or limited memory disclosure when processing malformed frames, affecting device stability and requiring urgent patching of affected kernels.

How an attack unfolds

An attacker on the same wireless network crafts and transmits a TKIP frame shorter than eight bytes for the MIC field; libipw accepts it without length validation, triggering the wrap and out-of-bounds read during MIC verification.

How to fix it

Apply the upstream kernel commit that adds an explicit MIC length check before verification and uses MICHAEL_MIC_LEN consistently; reboot systems after installing the patched kernel package for the distribution in use.

How to confirm the fix worked

Confirm the libipw source contains the length check prior to calling michael_mic() and that MICHAEL_MIC_LEN is used for all MIC size references; test by replaying short TKIP frames in a lab environment and verifying no oops or panic occurs.

Typical attack path

  1. Attacker associates or is within radio range of target Linux wireless interface using TKIP
  2. Attacker transmits a single crafted short TKIP data frame lacking a full MIC
  3. libipw_michael_mic_verify() performs unsigned length calculation that wraps
  4. michael_mic() reads past the end of the skb, causing panic or information leak

How to detect it

Review kernel logs for oops/panic messages referencing libipw, michael_mic, or skb over-reads; correlate with wireless interface activity showing TKIP frame reception around the timestamp of any crash.

What your security team should do

  • Immediately identify all Linux systems with wireless interfaces and schedule kernel updates within the next maintenance window
  • Disable TKIP in favor of CCMP/AES where wireless configuration allows until patches are deployed
  • Monitor vendor advisories for backported fixes in LTS kernels

The record

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject TKIP frames without a full MIC libipw_michael_mic_verify() assumes that an skb contains an eight-byte Michael MIC. A short TKIP frame makes the unsigned payload length wrap, causing michael_mic() to read past the skb. Check that the MIC is present before verifying it, and use the existing MICHAEL_MIC_LEN constant for all MIC lengths in the verifier.

Affected packages

Ecosystem Package Introduced Fixed