CVE-2026-93791

A moderate out-of-bounds access flaw was found in the Linux kernel Intel Wi-Fi (iwlwifi) driver. When handling block acknowledgment notifications, the driver uses a traffic identifier (TID) value supplied by the device firmware directly as an index into the tid_data[] array without validating it against IWL_MAX_TID_COUNT. A compromised or malicious Wi-Fi firmware could supply an out-of-range TID, causing an out-of-bounds read or write in kernel memory that can crash the kernel (denial of service) or corrupt kernel memory. This flaw is rated Moderate by Red Hat with a CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because the directly supported trigger requires the Wi-Fi firmware to be compromised or replaced, which normally requires prior privileged control of the system or its firmware; a practical remote attack path is not established by the upstream fix.

The kernel and kernel-rt packages in Red Hat Enterprise Linux 8, 9, and 10, the kernel and kernel-ivos-qualcomm components of Red Hat In-Vehicle OS 2, and OpenShift Container Platform 4 and 5 (through their RHEL CoreOS 8 and 9 kernels) are affected. Red Hat Enterprise Linux 6 and 7 Extended Life Cycle Support are not affected because the vulnerable code is not present in those kernels.

Fixes for the affected products are currently deferred. Because exploiting this flaw requires an already-compromised or malicious Wi-Fi firmware, which implies substantial prior control over the system, and the direct consequence is a denial of service, the fix is planned for a future update rather than an immediate release. The residual risk is a kernel crash or kernel memory corruption, limited to systems whose Wi-Fi firmware is already under attacker control.