VulnerabilityPublished 17 Sep 2026Updated 30 Oct 2026

CVE-2026-93062: Linux kernel · wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments

Source GCVE Database

Compare

Authoritative record:CVE-2026-93062· Medium

Not known to be exploited · fixed in f26f72c2448829701d7c3e840fac9d168a98a955 : update Linux kernel when convenient.

Data as of 30 Oct 2026, 18:18 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in f26f72c2448829701d7c3e840fac9d168a98a955, bc7a7ad93070879c74cdcb107ebb1a02ec212712, 897097eec925fbecdb1f8698b9e7bacb501a5b64 +3

Exploitation evidence

Disclosed: evidence found.
CVE published 17 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-x74j-6wvr-gpx3

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 14124b25780db542b2bc31aadecc37a2a6534f40, < f26f72c2448829701d7c3e840fac9d168a98a955	Fixed in f26f72c2448829701d7c3e840fac9d168a98a955
LinuxLinux	Affected ≥ 14124b25780db542b2bc31aadecc37a2a6534f40, < bc7a7ad93070879c74cdcb107ebb1a02ec212712	Fixed in bc7a7ad93070879c74cdcb107ebb1a02ec212712
LinuxLinux	Affected ≥ 14124b25780db542b2bc31aadecc37a2a6534f40, < 897097eec925fbecdb1f8698b9e7bacb501a5b64	Fixed in 897097eec925fbecdb1f8698b9e7bacb501a5b64
LinuxLinux	Affected ≥ 14124b25780db542b2bc31aadecc37a2a6534f40, < 9318bc0c41b24705690cf80d1596cf6b711e7027	Fixed in 9318bc0c41b24705690cf80d1596cf6b711e7027
LinuxLinux	Affected ≥ 14124b25780db542b2bc31aadecc37a2a6534f40, < 11dde137f1258004bd1ed76ea2480a641e1fb753	Fixed in 11dde137f1258004bd1ed76ea2480a641e1fb753
LinuxLinux	Affected ≥ 14124b25780db542b2bc31aadecc37a2a6534f40, < 6df26657c626b63b5a47026128cc021f66722a41	Fixed in 6df26657c626b63b5a47026128cc021f66722a41

AI-suggested

A fix has been implemented in the Linux kernel to prevent the division by zero condition by adding appropriate checks. Users should apply the official kernel updates that include this fix once available.

Description

A vulnerability in the Linux kernel's iwlwifi driver could lead to a division by zero error in the iwl_dbg_tlv_alloc_fragments function. The issue arises when the number of fragments (num_frags) is zero, which the patch addresses by adding checks to prevent this condition.

References

Community reviews

Loading reviews…