In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject TKIP frames without a full MIC libipw_michael_mic_verify() assumes that an skb contains an eight-byte Michael MIC. A short TKIP frame makes the unsigned payload length wrap, causing michael_mic() to read past the skb. Check that the MIC is present before verifying it, and use the existing MICHAEL_MIC_LEN constant for all MIC lengths in the verifier.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 5
- StatusReceived → PublishedNVD modified 2026-10-21 12:54
- References+1 references (now 5)NVD modified 2026-10-21 13:21
- StatusPublished → ReceivedNVD modified 2026-10-21 13:21
- StatusReceived → PublishedNVD modified 2026-10-19 09:15
- First seenunscoredNVD modified 2026-10-19 10:18
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 5
- https://git.kernel.org/stable/c/06f42accaf3c6aecab1dcc57f68dde6c06c8b380
- https://git.kernel.org/stable/c/9a7fb67364817710c96785ff86b71a2711ee92cb
- https://git.kernel.org/stable/c/ac7c08626f67844336086cf563f417566b76f0d7
- https://git.kernel.org/stable/c/bb7ae8910cc886885aea95abb7c2e578a2341646
- https://git.kernel.org/stable/c/f448b267968d0ee985e5927c868c8f858169ab34