CVE-2026-93805: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-7vqv-hxrc-vvx2
Share
Published
Advisory Summary

CVE-2026-93805 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-93805 at a Glance

CVE Identifier CVE-2026-93805
GHSA Identifier GHSA-7vqv-hxrc-vvx2
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-93805

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-93805, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate rx/tx MLME callback frame lengths before access cfg80211_rx_mlme_mgmt() and cfg80211_tx_mlme_mgmt() call tracepoints before rejecting frames shorter than the frame-control field. After that, they only require len >= 2 before dispatching into subtype handlers that assume their fixed fields are present. The frames that trip this are not shorter than 2 bytes; they are short relative to their subtype. mwifiex is a concrete in-tree example on the length side: mwifiex_process_mgmt_packet() only requires a 4-address ieee80211_hdr plus the 2-byte firmware length prefix before handing the frame to cfg80211_rx_mlme_mgmt(). After stripping the length prefix and removing addr4, pkt_len can be exactly 24: a bare 3-address management header with no reason-code body. The existing WARN_ON(len < 2) does not fire on such a frame, and cfg80211_process_deauth() then reads u.deauth.reason_code as a two-byte access starting at offset 24, immediately past the 24-byte buffer. Add a frame-control length gate, then validate each subtype's minimum frame size in an if/else-if chain that mirrors the dispatch logic. Trace only after the frame is known to be well-formed. Side effects of this change: - The WARN_ON(len < 2) is dropped. It only guarded the frame_control read, never the subtype fixed fields, and it does not fire on the frames that actually trigger the out-of-bounds read (which are >= 2). The len >= 2 check is kept as the guard before dereferencing frame_control, but without the warning: these are exported callbacks and a malformed frame from a driver should be dropped silently rather than backtraced. - cfg80211_tx_mlme_mgmt() previously routed every non-deauth subtype through disassociation handling; it now silently ignores unrecognised subtypes.

References

NVD — CVE-2026-93805 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-93805
git.kernel.org/stable/c/0ec738a0d3... WEB
https://git.kernel.org/stable/c/0ec738a0d361d7eb37188117166d201f9df622d3
git.kernel.org/stable/c/6bdf4dcff9... WEB
https://git.kernel.org/stable/c/6bdf4dcff98df634e04ebf99f52027a48d7f78ff
git.kernel.org/stable/c/6eb4bd50be... WEB
https://git.kernel.org/stable/c/6eb4bd50be53f5afbabb3a3b5153276e08fa7a4a
git.kernel.org/stable/c/8f4127a93c... WEB
https://git.kernel.org/stable/c/8f4127a93cf60d561ad39849a9ac763ba0e14db5
git.kernel.org/stable/c/ce2a3be690... WEB
https://git.kernel.org/stable/c/ce2a3be6909462f49c34de96be71f0ad5f0d573f
git.kernel.org/stable/c/d5e4586546... WEB
https://git.kernel.org/stable/c/d5e4586546974179feca305a94e07fac3e9727fe

Frequently Asked Questions

What is CVE-2026-93805?
CVE-2026-93805 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-93805?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-93805?
CVE-2026-93805 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-93805?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-7vqv-hxrc-vvx2",
  "modified" : "2026-10-03T12:31:09Z",
  "published" : "2026-09-24T18:31:29Z",
  "aliases" : [ "CVE-2026-93805" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: validate rx/tx MLME callback frame lengths before access\n\ncfg80211_rx_mlme_mgmt() and cfg80211_tx_mlme_mgmt() call tracepoints\nbefore rejecting frames shorter than the frame-control field. After\nthat, they only require len >= 2 before dispatching into subtype\nhandlers that assume their fixed fields are present.\n\nThe frames that trip this are not shorter than 2 bytes; they are short\nrelative to their subtype. mwifiex is a concrete in-tree example on the\nlength side: mwifiex_process_mgmt_packet() only requires a 4-address\nieee80211_hdr plus the 2-byte firmware length prefix before handing the\nframe to cfg80211_rx_mlme_mgmt(). After stripping the length prefix and\nremoving addr4, pkt_len can be exactly 24: a bare 3-address management\nheader with no reason-code body. The existing WARN_ON(len < 2) does not\nfire on such a frame, and cfg80211_process_deauth() then reads\nu.deauth.reason_code as a two-byte access starting at offset 24,\nimmediately past the 24-byte buffer.\n\nAdd a frame-control length gate, then validate each subtype's minimum\nframe size in an if/else-if chain that mirrors the dispatch logic. Trace\nonly after the frame is known to be well-formed.\n\nSide effects of this change:\n - The WARN_ON(len < 2) is dropped. It only guarded the frame_control\n   read, never the subtype fixed fields, and it does not fire on the\n   frames that actually trigger the out-of-bounds read (which are >= 2).\n   The len >= 2 check is kept as the guard before dereferencing\n   frame_control, but without the warning: these are exported callbacks\n   and a malformed frame from a driver should be dropped silently rather\n   than backtraced.\n - cfg80211_tx_mlme_mgmt() previously routed every non-deauth subtype\n   through disassociation handling; it now silently ignores unrecognised\n   subtypes.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-93805"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/0ec738a0d361d7eb37188117166d201f9df622d3"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/6bdf4dcff98df634e04ebf99f52027a48d7f78ff"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/6eb4bd50be53f5afbabb3a3b5153276e08fa7a4a"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/8f4127a93cf60d561ad39849a9ac763ba0e14db5"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/ce2a3be6909462f49c34de96be71f0ad5f0d573f"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/d5e4586546974179feca305a94e07fac3e9727fe"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-09-24T17:17:13Z"
  }
}