{"id":"CVE-2026-98889","kind":"vulnerability","aliases":["CVE-2026-98889"],"related":[],"title":"Linux kernel: iwlwifi scheduled scan can overflow a probe request buffer","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: fix sched scan IE sizing\n\nScheduled scan built the probe request before iwl_mvm_scan_fits(),\nso oversized IEs could be copied into the fixed preq buffer before\nlength validation. Move iwl_mvm_build_scan_probe() after the fits\ncheck.\n\nAlso advertise max_sched_scan_ie_len using iwl_mvm_max_scan_ie_len()\nso userspace limits account for driver-inserted DS/TPC bytes.","summary":"In the Linux kernel's iwlwifi Wi-Fi driver, a scheduled scan copied oversized information elements into a fixed-size probe request buffer before the length check ran. The fix moves the probe build after the check and advertises a correct maximum IE length to userspace.","severity":"unknown","cvss":null,"epss":0.00215,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","intel-iwlwifi","linux-kernel","self-hosted","wifi"],"not_affected_if":["driver-not-loaded","no-intel-wifi-hardware"],"how_to_check":"- unknown","fix":"- Update the Linux kernel to a release that includes the upstream fix for iwlwifi mvm sched scan IE sizing.","status":"open","published_at":"2026-10-23T12:18:22+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T05:00:02+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"infrastructure","confidence":0.35,"triage":{"at":"2026-10-25T05:00:02Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix for iwlwifi mvm sched scan IE sizing.","reach":"unknown","title":"Linux kernel: iwlwifi scheduled scan can overflow a probe request buffer","impact":"medium","summary":"In the Linux kernel's iwlwifi Wi-Fi driver, a scheduled scan copied oversized information elements into a fixed-size probe request buffer before the length check ran. The fix moves the probe build after the check and advertises a correct maximum IE length to userspace.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","wifi","intel-iwlwifi","self-hosted"],"confidence":0.35,"needs_auth":"unknown","worst_case":"unknown","analyst_note":"Check the NVD entry and the upstream kernel commit for the affected version ranges, the trigger path, and the fixed stable kernel releases.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-intel-wifi-hardware","driver-not-loaded"],"who_is_affected":"Systems running a Linux kernel with the iwlwifi driver for Intel wireless adapters and mvm firmware support, where scheduled Wi-Fi scans are used. Systems without Intel iwlwifi hardware, or kernels without this driver, are not affected. The sources do not say whether unprivileged or remote triggering is possible.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000613,"input_tokens":3414,"output_tokens":543,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98889':14A,17A 'account':147C 'advertis':69B,131C 'also':130C 'buffer':11A,53B,116C 'build':64B,123C 'built':97C 'byte':153C 'check':57B,67B,129C 'copi':42B,111C 'correct':71B 'could':109C 'cve':12A,15A 'driver':38B,150C 'driver-insert':149C 'ds/tpc':152C 'element':45B 'fi':37B 'fit':105C,128C 'fix':49B,60B,90C,114C 'fixed-s':48B 'follow':82C 'host':27B 'ie':73B,93C,108C,135C,142C 'inform':44B 'infrastructur':18B 'insert':151C 'intel':20B 'intel-iwlwifi':19B 'iwl':102C,121C,138C 'iwlwifi':3A,21B,34B,88C 'kernel':2A,24B,32B,80C 'len':136C,143C 'length':56B,74B,118C 'limit':146C 'linux':1A,23B,31B,79C 'linux-kernel':22B 'max':132C,140C 'maximum':72B 'move':61B,120C 'mvm':89C,103C,122C,139C 'overflow':7A 'overs':43B,107C 'preq':115C 'probe':9A,51B,63B,99C,125C 'ran':58B 'request':10A,52B,100C 'resolv':86C 'scan':5A,41B,92C,96C,104C,124C,134C,141C 'sched':91C,133C 'schedul':4A,40B,95C 'self':26B 'self-host':25B 'size':50B,94C 'use':137C 'userspac':76B,145C 'valid':119C 'vulner':83C 'wi':36B 'wi-fi':35B 'wifi':28B,87C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the iwlwifi driver for Intel wireless adapters and mvm firmware support, where scheduled Wi-Fi scans are used. Systems without Intel iwlwifi hardware, or kernels without this driver, are not affected. The sources do not say whether unprivileged or remote triggering is possible.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T12:18:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98889","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98889","severity":null,"published_at":"2026-10-23T12:18:22+00:00","modified_at":"2026-10-23T12:18:22+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98889","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98889","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}