VulnerabilityPublished 17 Sep 2026Updated 19 Oct 2026

CVE-2026-93062: Linux kernel · wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in f26f72c2448829701d7c3e840fac9d168a98a955 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 17:16 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS: 0.2% chance of exploitation in 30 days – higher than 10% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in f26f72c2448829701d7c3e840fac9d168a98a955, bc7a7ad93070879c74cdcb107ebb1a02ec212712, 9318bc0c41b24705690cf80d1596cf6b711e7027 +2

Exploitation evidence

Disclosed: evidence found.
CVE published 17 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 14124b25780db542b2bc31aadecc37a2a6534f40, < f26f72c2448829701d7c3e840fac9d168a98a955	Fixed in f26f72c2448829701d7c3e840fac9d168a98a955
LinuxLinux	Affected ≥ 14124b25780db542b2bc31aadecc37a2a6534f40, < bc7a7ad93070879c74cdcb107ebb1a02ec212712	Fixed in bc7a7ad93070879c74cdcb107ebb1a02ec212712
LinuxLinux	Affected ≥ 14124b25780db542b2bc31aadecc37a2a6534f40, < 9318bc0c41b24705690cf80d1596cf6b711e7027	Fixed in 9318bc0c41b24705690cf80d1596cf6b711e7027
LinuxLinux	Affected ≥ 14124b25780db542b2bc31aadecc37a2a6534f40, < 11dde137f1258004bd1ed76ea2480a641e1fb753	Fixed in 11dde137f1258004bd1ed76ea2480a641e1fb753
LinuxLinux	Affected ≥ 14124b25780db542b2bc31aadecc37a2a6534f40, < 6df26657c626b63b5a47026128cc021f66722a41	Fixed in 6df26657c626b63b5a47026128cc021f66722a41
LinuxLinux	Affected =5.5	Fixed in–

AI-suggested

The vulnerability has been fixed in multiple Linux kernel commits as listed in the established facts. Users should update their Linux kernel to a version including these fixes to remediate the issue. Since this is a kernel-level fix, applying the official kernel updates is the recommended mitigation.

Description

A division by zero vulnerability was identified and fixed in the iwlwifi driver of the Linux kernel. The flaw involved a potential zero value for the number of fragments (num_frags) during memory allocation in the iwl_dbg_tlv_alloc_fragments function. The fix ensures that the required size is not zero and adds checks to prevent num_frags from being zero.

Impact

The vulnerability could cause a division by zero error within the kernel's wireless driver, potentially leading to kernel crashes or instability. No known exploits in the wild have been reported. The impact is limited to affected Linux kernel versions running the vulnerable iwlwifi driver.

Summary

CVE-2026-93062 addresses a division by zero vulnerability in the Linux kernel's iwlwifi driver, specifically in the iwl_dbg_tlv_alloc_fragments function. The vulnerability could occur if the number of fragments (num_frags) was zero, leading to a division by zero error. The patch introduces validation to ensure the required size is not zero and enforces a check on num_frags to prevent this condition.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 15:01 UTC

Technical details

References

Community reviews

Related threats