Medium severity · published Sep 8, 2026
CVE-2026-56101
OpenBSD ieee80211_crypto_tkip.c TKIP MIC Countermeasure Logic Inversion DoS
5.3
CVSS
0.6%
EPSS
No
On KEV
Description
OpenBSD before commit 1ee99df contains an inverted comparison vulnerability in the ieee80211_michael_mic_failure() function within sys/net80211/ieee80211_crypto_tkip.c that allows unauthenticated attackers within RF range to trigger denial of service by sending two malformed TKIP frames separated by more than 60 seconds. Attackers can exploit the reversed TKIP MIC failure countermeasure window check to deauthenticate all associated TKIP stations and block reassociation for up to 90 seconds, while within-window MIC failures that should engage countermeasures are silently discarded, leaving key-recovery attempts undetected.
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Adjacent
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
OpenBSD · OpenBSD
before 1ee99dfcc4ddc87afc6395d5d3094e9d2314fb5a · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-56101
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-56101
github.com
https://github.com/openbsd/src/commit/1ee99dfcc4ddc87afc6395d5d3094e9d2314fb5a
pop.argus-systems.ai
https://pop.argus-systems.ai/advisory/adv-209.html
www.vulncheck.com
https://www.vulncheck.com/advisories/openbsd-ieee80211-crypto-tkip-c-tkip-mic-countermeasure-logic-inversion-dos
More from OpenBSD
9.8
CVE-2024-10934
In OpenBSD 7.5 before errata 008 and OpenBSD 7.4 before errata 021, avoid possible mbuf double free in NFS client and server implementation, do not use uninitialized variable in…
9.8
CVE-2024-29937
NFS in a BSD derived codebase, as used in OpenBSD through 7.4 and FreeBSD through 14.0-RELEASE, allows remote attackers to execute arbitrary code via a bug that is unrelated to…
9.8
CVE-2023-35784
A double free or use after free could occur after SSL_clear in OpenBSD 7.2 before errata 026 and 7.3 before errata 004, and in LibreSSL before 3.6.3 and 3.7.x before 3.7.3
9.8
CVE-2021-46880
x509/x509_verify.c in LibreSSL before 3.4.2, and OpenBSD before 7.0 errata 006, allows authentication bypass because an error for an unverified certificate chain is sometimes…
9.8
CVE-2020-16088
iked in OpenIKED, as used in OpenBSD through 6.7, allows authentication bypass because ca.c has the wrong logic for checking whether a public key matches