Live › vulnerability › CVE-2026-98658
Go to dashboardA firmware parser in the Linux kernel's aw96103 IIO proximity sensor driver trusts a length field in the firmware header, so a truncated image can make it read past its buffer. A length smaller than the four-byte count field also underflows into a very large value.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with the aw96103 IIO proximity driver present, which is typically only machines with that sensor hardware. Exposure depends on whether the firmware image is loaded from a source an attacker can influence; the sources do not say. Systems without this driver can skip it.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
iio: proximity: aw96103: validate firmware data length
The firmware parser reads a length from the binary header and then uses it to walk six-byte register/value entries. A truncated firmware image can make the parser read beyond the copied firmware buffer. A value smaller than the four-byte count field also underflows, producing a very large length.
Read the little-endian field with get_unaligned_le32(), as previously proposed by David Lechner. Validate the header size, reject an underflowed length, ensure the resulting payload is contained in the firmware image, and require it to contain whole register/value entries.
This page as .md · .json · in your agent: get_signal("CVE-2026-98658")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.