CVE-2026-93788
Description
A flaw was found in the Linux kernel's iwlwifi wireless driver. When processing Advanced Configuration and Power Interface (ACPI) data, the driver does not properly validate the revision index of the WiFi Global Dynamic SAR (WGDS) table before performing a bit-shift calculation. An invalid revision value reported by the device firmware can trigger an undefined shift operation, potentially resulting in system instability or a Denial of Service (DoS).
Statement
A flaw was found in the Linux kernel's iwlwifi wireless driver, which Red Hat rates as LOW impact. When processing Advanced Configuration and Power Interface (ACPI) data, the driver does not validate the revision index of the WiFi Global Dynamic SAR (WGDS) table before using it in a bit-shift calculation (BIT(tbl_rev)). An invalid revision value reported by the platform firmware can trigger an undefined shift operation, potentially causing system instability or a denial of service. Reliable triggering requires control of platform ACPI data or device firmware, so the issue is not reachable through normal WiFi network traffic, and the undefined shift does not provide a memory-corruption primitive. For these reasons the Red Hat impact rating is lower than what the CVSS 3.1 base score of 5.5 (MODERATE) alone would suggest. Red Hat Enterprise Linux 6 and 7 (kernel and kernel-rt) and the RHEL 8.4 z-stream are not affected because the vulnerable code is not present. The vulnerable code is present in Red Hat Enterprise Linux 8, 9, and 10 (kernel and kernel-rt), Red Hat In-Vehicle OS, and OpenShift Container Platform RHEL CoreOS images; for these affected products the fix is currently deferred given the low practical impact and the high privileges needed to trigger the flaw, and the residual risk is limited to local denial of service by an actor who already controls platform firmware or ACPI tables.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
