Executive brief
The Linux kernel's Intel Wi-Fi driver (iwlwifi) contains a buffer overflow vulnerability in the MEI (Management Engine Interface) module that processes SAP (Service Access Point) messages from the wireless hardware. An attacker with local access or the ability to send crafted messages from the chipset can trigger a buffer overflow, potentially leading to kernel crash, privilege escalation, or arbitrary code execution on systems using affected Intel Wi-Fi adapters.
Technical details
The vulnerability is a classic stack buffer overflow in the iwlwifi MEI driver's SAP message handling function (iwl_mei_handle_sap_rx_cmd in drivers/net/wireless/intel/iwlwifi/mei/main.c). The code reads the SAP message length from a network packet header without first validating that the message size will not exceed the local buffer capacity (PAGE_SIZE). An attacker can craft a SAP message with an oversized length field to trigger the overflow. The fix adds a length validation check before reading the message: `if (len + sizeof(*hdr) > PAGE_SIZE)` followed by error handling. The vulnerability affects Linux kernel versions where the original vulnerable code was introduced and requires local or physical access to the MEI device, or exploitation through a compromised firmware/chipset component.
Affected products
- Linux kernel Kernel versions from introduction of vulnerable code (commit bcd68b3dbe78) through unspecified fixed versions
Timeline
- 2026-09-17: disclosed: CVE-2026-93063 published
- 2026-09-14: patched: Fix merged into stable Linux kernel
- 2026-07-15: other: Original patch commit date