Live › vulnerability › CVE-2026-98830
Go to dashboardThe wfx Wi-Fi driver copies a firmware MIB reply into a caller buffer without checking the reply length against the buffer size. A firmware response with an oversized length field overruns the caller buffer and reads past the reply allocation.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running the Linux kernel with the wfx Wi-Fi driver (Silicon Labs WFx chips) loaded. The sources do not say which kernel versions or hardware are affected in practice; the trigger depends on malformed firmware responses from the wireless chip. Systems without a WFx device or without this driver can skip it.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
wifi: wfx: validate MIB read length before copying to caller
wfx_hif_read_mib() copies reply->length bytes from the firmware response into the caller-provided buffer without checking that reply->length does not exceed val_len. A firmware response with a length field larger than expected overruns the caller buffer and reads past the end of the reply allocation.
Replace the dead -ENOMEM check with an active validation that reply->length fits within val_len before the memcpy.
This page as .md · .json · in your agent: get_signal("CVE-2026-98830")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.