CVE-2026-98830wifi: wfx: validate MIB read length before copying to caller
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: wifi: wfx: validate MIB read length before copying to caller wfx_hif_read_mib() copies reply->length bytes from the firmware response into the caller-provided buffer without checking that reply->length does not exceed val_len. A firmware response with a length field larger than expected overruns the caller buffer and reads past the end of the reply allocation. Replace the dead -ENOMEM check with an active validation that reply->length fits within val_len before the memcpy.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 18, 2026
- First seen by InfoSec Signals
- Oct 18, 2026
Affected products
Linux Linux linux:linux (from the name) | from f95a29d40782f4f0052a692a822de3ba044b19ff before 02886c18a340da59df57365f29009e1258bfe333; from f95a29d40782f4f0052a692a822de3ba044b19ff before 71d140099165de03128c00dd129f1eab21c6a3c4; from f95a29d40782f4f0052a692a822de3ba044b19ff before 7acb36fd60a3e7b858f12e69a919c3609b281408; from f95a29d40782f4f0052a692a822de3ba044b19ff before ce67ebe9d8629776ce38e6995ae72fb903c828db | CNA record |
References
- https://git.kernel.org/stable/c/02886c18a340da59df57365f29009e1258bfe333
- https://git.kernel.org/stable/c/71d140099165de03128c00dd129f1eab21c6a3c4
- https://git.kernel.org/stable/c/7acb36fd60a3e7b858f12e69a919c3609b281408
- https://git.kernel.org/stable/c/ce67ebe9d8629776ce38e6995ae72fb903c828db
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.