{"id":"CVE-2026-98830","kind":"vulnerability","aliases":["CVE-2026-98830"],"related":[],"title":"Linux kernel: wfx Wi-Fi driver overruns buffer on oversized firmware MIB reply","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wfx: validate MIB read length before copying to caller\n\nwfx_hif_read_mib() copies reply->length bytes from the firmware\nresponse into the caller-provided buffer without checking that\nreply->length does not exceed val_len. A firmware response with\na length field larger than expected overruns the caller buffer and\nreads past the end of the reply allocation.\n\nReplace the dead -ENOMEM check with an active validation that\nreply->length fits within val_len before the memcpy.","summary":"The wfx Wi-Fi driver copies a firmware MIB reply into a caller buffer without checking the reply length against the buffer size. A firmware response with an oversized length field overruns the caller buffer and reads past the reply allocation.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-kernel","wfx","wifi"],"not_affected_if":["no-wfx-hardware"],"how_to_check":"- unknown","fix":"- Update the Linux kernel to a release that includes the wfx validation fix (kernel version unknown from sources)","status":"open","published_at":"2026-10-18T16:17:37+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:13:21+00:00","updated_at":"2026-10-25T05:13:21+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:13:21Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the wfx validation fix (kernel version unknown from sources)","reach":"local","title":"Linux kernel: wfx Wi-Fi driver overruns buffer on oversized firmware MIB reply","impact":"medium","summary":"The wfx Wi-Fi driver copies a firmware MIB reply into a caller buffer without checking the reply length against the buffer size. A firmware response with an oversized length field overruns the caller buffer and reads past the reply allocation.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","wifi","wfx"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; memory overrun from a malformed firmware reply","analyst_note":"Check the upstream kernel commit and stable backports at https://nvd.nist.gov/vuln/detail/CVE-2026-98830 for affected and fixed kernel versions.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-wfx-hardware"],"who_is_affected":"Systems running the Linux kernel with the wfx Wi-Fi driver (Silicon Labs WFx chips) loaded. The sources do not say which kernel versions or hardware are affected in practice; the trigger depends on malformed firmware responses from the wireless chip. Systems without a WFx device or without this driver can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000604,"input_tokens":3390,"output_tokens":529,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-98830':17A,20A 'activ':147C 'alloc':68B,139C 'buffer':9A,41B,49B,62B,106C,130C 'byte':96C 'caller':40B,61B,88C,104C,129C 'caller-provid':103C 'check':43B,108C,144C 'copi':33B,86C,93C 'cve':15A,18A 'dead':142C 'driver':7A,32B 'end':135C 'enomem':143C 'exceed':114C 'expect':126C 'fi':6A,31B 'field':58B,123C 'firmwar':12A,35B,52B,99C,118C 'fit':152C 'follow':74C 'hif':90C 'infrastructur':21B 'kernel':2A,24B,72C 'larger':124C 'len':116C,155C 'length':46B,57B,84C,95C,111C,122C,151C 'linux':1A,23B,71C 'linux-kernel':22B 'memcpi':158C 'mib':13A,36B,82C,92C 'overrun':8A,59B,127C 'overs':11A,56B 'past':65B,133C 'provid':105C 'read':64B,83C,91C,132C 'replac':140C 'repli':14A,37B,45B,67B,94C,110C,138C,150C 'resolv':78C 'respons':53B,100C,119C 'size':50B 'val':115C,154C 'valid':81C,148C 'vulner':75C 'wfx':3A,25B,28B,80C,89C 'wi':5A,30B 'wi-fi':4A,29B 'wifi':26B,79C 'within':153C 'without':42B,107C","nicknames":[],"mitigations":[],"who_affected":"Systems running the Linux kernel with the wfx Wi-Fi driver (Silicon Labs WFx chips) loaded. The sources do not say which kernel versions or hardware are affected in practice; the trigger depends on malformed firmware responses from the wireless chip. Systems without a WFx device or without this driver can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:37+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98830","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98830","severity":null,"published_at":"2026-10-18T16:17:37+00:00","modified_at":"2026-10-21T13:21:48+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}