CVE-2026-97500

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97500", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-24T16:01:01.151Z", "datePublished": "2026-09-24T16:04:47.116Z", "dateUpdated": "2026-10-30T12:37:05.075Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:37:05.075Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: phy: check length before parsing PHY status IE\n\nHardware might report PHY status IE with unexpected length, and parser\nmight access out of range. Check the length ahead."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/realtek/rtw89/core.c"], "versions": [{"version": "e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd", "lessThan": "a8659bacf9a2a4f33690c573f35bb5b11d06bf12", "status": "affected", "versionType": "git"}, {"version": "e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd", "lessThan": "72bf6944e336d6f046f5c886ebededdd6560a693", "status": "affected", "versionType": "git"}, {"version": "e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd", "lessThan": "213f9e0ab2b4f35fe8d342333238c6cc91513fbf", "status": "affected", "versionType": "git"}, {"version": "e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd", "lessThan": "98e5720afd7495eece580238f232e3b3b4c022da", "status": "affected", "versionType": "git"}, {"version": "e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd", "lessThan": "884495c39de1a02f42bd40051b921e2311d6ac91", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/realtek/rtw89/core.c"], "versions": [{"version": "5.16", "status": "affected"}, {"version": "0", "lessThan": "5.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a8659bacf9a2a4f33690c573f35bb5b11d06bf12"}, {"url": "https://git.kernel.org/stable/c/72bf6944e336d6f046f5c886ebededdd6560a693"}, {"url": "https://git.kernel.org/stable/c/213f9e0ab2b4f35fe8d342333238c6cc91513fbf"}, {"url": "https://git.kernel.org/stable/c/98e5720afd7495eece580238f232e3b3b4c022da"}, {"url": "https://git.kernel.org/stable/c/884495c39de1a02f42bd40051b921e2311d6ac91"}], "title": "wifi: rtw89: phy: check length before parsing PHY status IE", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/wireless/realtek/rtw89/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a8659bacf9a2a4f33690c573f35bb5b11d06bf12", "status": "affected", "version": "e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd", "versionType": "git"}, {"lessThan": "72bf6944e336d6f046f5c886ebededdd6560a693", "status": "affected", "version": "e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd", "versionType": "git"}, {"lessThan": "213f9e0ab2b4f35fe8d342333238c6cc91513fbf", "status": "affected", "version": "e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd", "versionType": "git"}, {"lessThan": "98e5720afd7495eece580238f232e3b3b4c022da", "status": "affected", "version": "e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd", "versionType": "git"}, {"lessThan": "884495c39de1a02f42bd40051b921e2311d6ac91", "status": "affected", "version": "e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/wireless/realtek/rtw89/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.16"}, {"lessThan": "5.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: phy: check length before parsing PHY status IE\n\nHardware might report PHY status IE with unexpected length, and parser\nmight access out of range. Check the length ahead."}], "id": "CVE-2026-97500", "lastModified": "2026-10-30T13:21:05.490", "metrics": {}, "published": "2026-09-24T17:17:27.740", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/213f9e0ab2b4f35fe8d342333238c6cc91513fbf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/72bf6944e336d6f046f5c886ebededdd6560a693"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/884495c39de1a02f42bd40051b921e2311d6ac91"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/98e5720afd7495eece580238f232e3b3b4c022da"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a8659bacf9a2a4f33690c573f35bb5b11d06bf12"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: wifi: rtw89: phy: check length before parsing PHY status IE", "id": "2540462", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540462"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nwifi: rtw89: phy: check length before parsing PHY status IE\nHardware might report PHY status IE with unexpected length, and parser\nmight access out of range. Check the length ahead.", "A flaw was found in the Linux kernel's Realtek Wi-Fi driver (rtw89). The driver fails to validate the length of physical layer (PHY) status information elements before parsing received data. A malicious or malfunctioning wireless device could exploit this flaw by providing status data with an unexpected length, triggering an out-of-bounds memory read. This issue primarily leads to a kernel crash and a Denial of Service (DoS)."], "name": "CVE-2026-97500", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97500\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97500\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97500.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,213f9e0ab2b4f35fe8d342333238c6cc91513fbf)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,98e5720afd7495eece580238f232e3b3b4c022da)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,884495c39de1a02f42bd40051b921e2311d6ac91)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.12.111)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.18.53)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.111,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.53,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T00:45:17.127861+00:00", "updated": "2026-10-01T12:00:06.858796+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}