Live › vulnerability › CVE-2026-98889
Go to dashboardIn the Linux kernel's iwlwifi Wi-Fi driver, a scheduled scan copied oversized information elements into a fixed-size probe request buffer before the length check ran. The fix moves the probe build after the check and advertises a correct maximum IE length to userspace.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with the iwlwifi driver for Intel wireless adapters and mvm firmware support, where scheduled Wi-Fi scans are used. Systems without Intel iwlwifi hardware, or kernels without this driver, are not affected. The sources do not say whether unprivileged or remote triggering is possible.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mvm: fix sched scan IE sizing
Scheduled scan built the probe request before iwl_mvm_scan_fits(), so oversized IEs could be copied into the fixed preq buffer before length validation. Move iwl_mvm_build_scan_probe() after the fits check.
Also advertise max_sched_scan_ie_len using iwl_mvm_max_scan_ie_len() so userspace limits account for driver-inserted DS/TPC bytes.
This page as .md · .json · in your agent: get_signal("CVE-2026-98889")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.