{"id":"CVE-2026-98658","kind":"vulnerability","aliases":["CVE-2026-98658"],"related":[],"title":"Linux kernel: AW96103 proximity driver over-reads truncated firmware images","description":"In the Linux kernel, the following vulnerability has been resolved:\n\niio: proximity: aw96103: validate firmware data length\n\nThe firmware parser reads a length from the binary header and then uses\nit to walk six-byte register/value entries. A truncated firmware image\ncan make the parser read beyond the copied firmware buffer. A value\nsmaller than the four-byte count field also underflows, producing a very\nlarge length.\n\nRead the little-endian field with get_unaligned_le32(), as previously\nproposed by David Lechner. Validate the header size, reject an\nunderflowed length, ensure the resulting payload is contained in the\nfirmware image, and require it to contain whole register/value entries.","summary":"A firmware parser in the Linux kernel's aw96103 IIO proximity sensor driver trusts a length field in the firmware header, so a truncated image can make it read past its buffer. A length smaller than the four-byte count field also underflows into a very large value.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["embedded","iio","linux-kernel","runtime"],"not_affected_if":["driver-not-built"],"how_to_check":"- unknown","fix":"- Update to a Linux kernel release that includes the upstream fix titled 'iio: proximity: aw96103: validate firmware data length' (version unknown from sources).","status":"open","published_at":"2026-10-18T16:17:19+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:19:32+00:00","updated_at":"2026-10-25T05:19:32+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:19:32Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the upstream fix titled 'iio: proximity: aw96103: validate firmware data length' (version unknown from sources).","reach":"local","title":"Linux kernel: AW96103 proximity driver over-reads truncated firmware images","impact":"medium","summary":"A firmware parser in the Linux kernel's aw96103 IIO proximity sensor driver trusts a length field in the firmware header, so a truncated image can make it read past its buffer. A length smaller than the four-byte count field also underflows into a very large value.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","iio","embedded"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Out-of-bounds memory read while parsing firmware data in the kernel","analyst_note":"Check the NVD entry and the upstream kernel commit for affected version ranges and whether firmware can be supplied by unprivileged users.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["driver-not-built"],"who_is_affected":"Systems running a Linux kernel with the aw96103 IIO proximity driver present, which is typically only machines with that sensor hardware. Exposure depends on whether the firmware image is loaded from a source an attacker can influence; the sources do not say. Systems without this driver can skip it.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.0006,"input_tokens":3431,"output_tokens":513,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98658':14A,17A 'also':66B,135C 'aw96103':3A,32B,85C 'beyond':120C 'binari':98C 'buffer':55B,124C 'byte':63B,108C,132C 'contain':171C,180C 'copi':122C 'count':64B,133C 'cve':12A,15A 'data':88C 'david':156C 'driver':5A,36B 'embed':18B 'endian':146C 'ensur':166C 'entri':110C,183C 'field':40B,65B,134C,147C 'firmwar':10A,25B,43B,87C,91C,113C,123C,174C 'follow':78C 'four':62B,131C 'four-byt':61B,130C 'get':149C 'header':44B,99C,160C 'iio':19B,33B,83C 'imag':11A,48B,114C,175C 'kernel':2A,22B,30B,76C 'larg':71B,140C 'le32':151C 'lechner':157C 'length':39B,57B,89C,95C,141C,165C 'linux':1A,21B,29B,75C 'linux-kernel':20B 'littl':145C 'little-endian':144C 'make':50B,116C 'over-read':6A 'parser':26B,92C,118C 'past':53B 'payload':169C 'previous':153C 'produc':137C 'propos':154C 'proxim':4A,34B,84C 'read':8A,52B,93C,119C,142C 'register/value':109C,182C 'reject':162C 'requir':177C 'resolv':82C 'result':168C 'runtim':23B 'sensor':35B 'six':107C 'six-byt':106C 'size':161C 'smaller':58B,127C 'truncat':9A,47B,112C 'trust':37B 'unalign':150C 'underflow':67B,136C,164C 'use':102C 'valid':86C,158C 'valu':72B,126C 'vulner':79C 'walk':105C 'whole':181C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the aw96103 IIO proximity driver present, which is typically only machines with that sensor hardware. Exposure depends on whether the firmware image is loaded from a source an attacker can influence; the sources do not say. Systems without this driver can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:19+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98658","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98658","severity":null,"published_at":"2026-10-18T16:17:19+00:00","modified_at":"2026-10-19T10:19:30+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}