Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Linux kernel before 6.6.157.1-1 may leave Wi‑Fi key data exposed
published 1 month ago
Summary
The core operating system used in many servers and cloud services has a coding mistake that can fail to fully erase a wireless network key. This could allow someone with access to memory to see part of the key. Updating the kernel to the latest version fixes the issue.
What to do
- Update kernel to version 6.6.157.1-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | kernel | <= 6.6.150.1-1 |
| Azure Linux:3 | – | kernel |
<= 6.6.152.1-1 < 6.6.157.1-1 Fix: upgrade to 6.6.157.1-1
|
Original advisory text
CVE-2026-93064 affecting package kernel for versions less than 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser
iwl_mvm_frob_txf_key_iter() tracks the last matched byte position
in loop variable 'i'. When a full key match is found (match ==
keylen), 'i' points at the last byte of the matched key. The
memset start offset should therefore be i + 1 - keylen, not
i - keylen; the current code zeroes one byte before the match
and leaves the final key byte un-sanitised.
wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser
iwl_mvm_frob_txf_key_iter() tracks the last matched byte position
in loop variable 'i'. When a full key match is found (match ==
keylen), 'i' points at the last byte of the matched key. The
memset start offset should therefore be i + 1 - keylen, not
i - keylen; the current code zeroes one byte before the match
and leaves the final key byte un-sanitised.
References
Timeline
Published17 Sep 2026
Updated2 Oct 2026
First seen23 Sep 2026
Sources
AZL-102128 · OSV
Track software like this
Free during beta