---
id: CVE-2026-93281
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: rtw89: fix HE extended capability length check

  rtw89_mac_check_he_obss_narrow_bw_ru_iter() reads extended capability
  byte 10, but rejects only datalen values bel…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: rtw89: fix HE extended capability length check

  rtw89_mac_check_he_obss_narrow_bw_ru_iter() reads extended capability
  byte 10, but rejects only datalen values bel…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 8d540f9d29162e273797bef36686a010724f0f8a <
    eddf53f1edb0cf7f302bd15cdb47cca90948c205
  - >-
    Linux >= 8d540f9d29162e273797bef36686a010724f0f8a <
    655c4401c18d735dbaf2cc172ff4f626b3a896a0
  - >-
    Linux >= 8d540f9d29162e273797bef36686a010724f0f8a <
    bddbd1de765bf6ddc0473ad683910eb3a2a92a43
  - >-
    Linux >= 8d540f9d29162e273797bef36686a010724f0f8a <
    f2a01deff7d0d5cc3dcbf2358dac113979303c8e
  - >-
    Linux >= 8d540f9d29162e273797bef36686a010724f0f8a <
    f132fc01b359a0f7d81fe13d769ea4e7c4baa66e
  - >-
    Linux >= 8d540f9d29162e273797bef36686a010724f0f8a <
    2aba608a86e9b099c9af2ea70b620552dee2b628
  - Linux 6.1
published: '2026-09-24'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T16:17:25.440'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93281'
references:
  - url: 'https://git.kernel.org/stable/c/2aba608a86e9b099c9af2ea70b620552dee2b628'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/655c4401c18d735dbaf2cc172ff4f626b3a896a0'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/bddbd1de765bf6ddc0473ad683910eb3a2a92a43'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/eddf53f1edb0cf7f302bd15cdb47cca90948c205'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f132fc01b359a0f7d81fe13d769ea4e7c4baa66e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/f2a01deff7d0d5cc3dcbf2358dac113979303c8e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-24T16:47:15.842Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtw89: fix HE extended capability length check

rtw89_mac_check_he_obss_narrow_bw_ru_iter() reads extended capability
byte 10, but rejects only datalen values below 10.  Byte 10 requires at
least 11 bytes.

Require datalen >= 11 before reading data[10].

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.