---
id: CVE-2026-56101
title: >-
  OpenBSD before commit 1ee99df contains an inverted comparison vulnerability in
  the ieee80211_michael_mic_failure() function within
  sys/net80211/ieee80211_crypto_tkip.c that allows unauthenticated attackers
  within RF range to trigger deni…
summary: >-
  OpenBSD before commit 1ee99df contains an inverted comparison vulnerability in
  the ieee80211_michael_mic_failure() function within
  sys/net80211/ieee80211_crypto_tkip.c that allows unauthenticated attackers
  within RF range to trigger deni…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-697
vendor: OpenBSD
product: OpenBSD
affected:
  - OpenBSD < 1ee99dfcc4ddc87afc6395d5d3094e9d2314fb5a
published: '2026-09-08'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T16:17:15.607'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-56101'
references:
  - url: >-
      https://github.com/openbsd/src/commit/1ee99dfcc4ddc87afc6395d5d3094e9d2314fb5a
    label: disclosure@vulncheck.com
  - url: 'https://pop.argus-systems.ai/advisory/adv-209.html'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/openbsd-ieee80211-crypto-tkip-c-tkip-mic-countermeasure-logic-inversion-dos
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-10T13:49:14.964977Z'
epss: 0.00605
epssPercentile: 0.46685
ingestedAt: '2026-09-08T16:34:19.228Z'
---

## Overview

OpenBSD before commit 1ee99df contains an inverted comparison vulnerability in the ieee80211_michael_mic_failure() function within sys/net80211/ieee80211_crypto_tkip.c that allows unauthenticated attackers within RF range to trigger denial of service by sending two malformed TKIP frames separated by more than 60 seconds. Attackers can exploit the reversed TKIP MIC failure countermeasure window check to deauthenticate all associated TKIP stations and block reassociation for up to 90 seconds, while within-window MIC failures that should engage countermeasures are silently discarded, leaving key-recovery attempts undetected.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.