Executive brief
The Linux kernel's WiFi driver (iwlwifi) contains an off-by-one error in the code that scrubs sensitive encryption keys from firmware memory dumps. Due to this bug, the final byte of matched cryptographic keys is left un-sanitised while one byte before the key is incorrectly zeroed, potentially exposing sensitive key material in diagnostic output.
Technical details
The vulnerability is an off-by-one error in the iwl_mvm_frob_txf_key_iter() function in drivers/net/wireless/intel/iwlwifi/mvm/ops.c. When a full encryption key is matched in memory (match == keylen), the loop variable 'i' points to the last byte of the matched key. The buggy code uses offset "i - keylen" for the memset() call to sanitise the key, but the correct offset should be "i + 1 - keylen". This causes the function to zero one byte before the actual key start while leaving the final key byte uncleared. The fix changes the memset offset calculation to properly sanitise the entire matched key. No authentication or special privileges are required to trigger this; the bug manifests when firmware dumps containing keys are generated.
Affected products
- Linux Linux kernel multiple versions (iwlwifi driver component)
Timeline
- 2026-09-17: disclosed: CVE-2026-93064 published
- 2026-07-15: patched: Upstream commit f6a6c01cbc046f68e6916a7e047a1bc881c8c9ab