CVE-2026-93281

Not scored yetLast modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtw89: fix HE extended capability length check

rtw89_mac_check_he_obss_narrow_bw_ru_iter() reads extended capability byte 10, but rejects only datalen values below 10. Byte 10 requires at least 11 bytes.

Require datalen >= 11 before reading data[10].

Metrics

No CVSS score has been published yet.

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Sep 24, 2026
Last modified
Oct 19, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-932828.1In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix maximum allowed access checks The DACL permission check looCVE-2026-93283In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix device_register() error path When device_register() fCVE-2026-932848.8In the Linux kernel, the following vulnerability has been resolved: drm/pagemap: dma-unmap pages before handling migration errors drm_pageCVE-2026-93285In the Linux kernel, the following vulnerability has been resolved: f2fs: embed f2fs_gc_kthread in f2fs_sb_info Instead of allocating f2fsCVE-2026-93286In the Linux kernel, the following vulnerability has been resolved: net: appletalk: fix NULL pointer dereference in aarp_send_ddp() aarp_sCVE-2026-932877.8In the Linux kernel, the following vulnerability has been resolved: i2c: smbus: reject oversized block transfers in the common path The SMCVE-2026-932887.8In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernCVE-2026-932897.5The affected products are vulnerable to command injection attack that could allow an unauthenticated attacker to execute system commands durCVE-2026-932905.5Omni C20 uses hard-coded credentials that could allow an attacker to monitor log files to obtain credentials to access information like mappCVE-2026-932919.4Omni C20 lacks proper certificate validation which could allow an attacker to perform a man-in-the-middle attack which could allow them to eCVE-2026-932928.5SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate servicCVE-2026-932946.3A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana
CVE-2026-93281: Unscored | Vulnix