---
id: CVE-2026-93802
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: rsi: validate beacon length before fixed buffer copy

  rsi_prepare_beacon() copies the mac80211 beacon frame after
  FRAME_DESC_SZ into a management skb whose usable…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: rsi: validate beacon length before fixed buffer copy

  rsi_prepare_beacon() copies the mac80211 beacon frame after
  FRAME_DESC_SZ into a management skb whose usable…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    87710ad633ce4588aec88611d0d0745eb33a6991
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    266f195d5a14eec6c482fd09fbc924584c3371a7
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    8ecdeb8b8a33b22c597299043c0dcfce50beb9ea
  - Linux < 6.12.111
  - Linux < 6.18.53
  - Linux (all versions)
published: '2026-09-24'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T17:17:13.127'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93802'
references:
  - url: 'https://git.kernel.org/stable/c/266f195d5a14eec6c482fd09fbc924584c3371a7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/87710ad633ce4588aec88611d0d0745eb33a6991'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8ecdeb8b8a33b22c597299043c0dcfce50beb9ea'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-24T16:47:15.898Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: rsi: validate beacon length before fixed buffer copy

rsi_prepare_beacon() copies the mac80211 beacon frame after
FRAME_DESC_SZ into a management skb whose usable tailroom may be smaller
than MAX_MGMT_PKT_SIZE after alignment.

Validate the beacon length against the actual tailroom before the copy
and skb_put(). Leave ownership of the management skb with the caller on
error, matching the existing rsi_send_beacon() cleanup path.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.