OpenBSD TKIP MIC Failure Countercheck Inversion: DoS via RF
CVE-2026-56101 Published on September 8, 2026
OpenBSD ieee80211_crypto_tkip.c TKIP MIC Countermeasure Logic Inversion DoS
OpenBSD before commit 1ee99df contains an inverted comparison vulnerability in the ieee80211_michael_mic_failure() function within sys/net80211/ieee80211_crypto_tkip.c that allows unauthenticated attackers within RF range to trigger denial of service by sending two malformed TKIP frames separated by more than 60 seconds. Attackers can exploit the reversed TKIP MIC failure countermeasure window check to deauthenticate all associated TKIP stations and block reassociation for up to 90 seconds, while within-window MIC failures that should engage countermeasures are silently discarded, leaving key-recovery attempts undetected.
Vulnerability Analysis
Weakness Type
Incorrect Comparison
The software compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.
Products Associated with CVE-2026-56101
Want to know whenever a new CVE is published for OpenBSD? stack.watch will email you.
Affected Versions
OpenBSD:- Before 1ee99dfcc4ddc87afc6395d5d3094e9d2314fb5a is affected.