CVE-2026-98185 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: mwifiex: validate scan response extents
mwifiex_ret_802_11_scan() subtracts the fixed response fields and the firmware-provided BSS length from resp->size without first proving that either extent fits. A short response or oversized BSS length can therefore underflow tlv_buf_size and make the TLV parser walk beyond the command response.
Compute the fixed extent from the selected normal or background scan response. Validate that the fixed fields and BSS data fit before deriving the TLV extent and entering the parser.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified in the Linux kernel's mwifiex wireless driver represents a critical integer underflow condition within the network interface processing logic, specifically affecting how scan responses are parsed from firmware. The function mwifiex_ret_802_11_scan is responsible for handling scan result packets received from the hardware. In its current implementation prior to the fix, the code attempts to calculate the size of the Type-Length-Value buffer by subtracting the sizes of fixed response fields and a firmware-provided Basic Service Set length from the total response size. This arithmetic operation assumes that both the fixed extent and the BSS data are valid and smaller than or equal to the total response size provided in resp->size. However, there is no preliminary validation to ensure these components fit within the allocated buffer boundaries before performing the subtraction.
This lack of input validation creates a scenario where an attacker capable of manipulating network traffic or exploiting firmware behavior can trigger an integer underflow. If the incoming scan response packet has a total size that is smaller than the sum of the fixed fields and the BSS length, or if the firmware-provided BSS length field contains an abnormally large value due to corruption or malicious crafting, the subtraction result becomes negative when interpreted as an unsigned integer type commonly used in kernel buffer sizing. This underflow results in a massive positive value for tlv_buf_size, which is then passed to the TLV parser. Consequently, the parser attempts to read and process data from memory locations far beyond the actual bounds of the command response buffer.
The operational impact of this vulnerability extends beyond simple out-of-bounds reads. By allowing the TLV parser to walk beyond the allocated command response boundary, an attacker can potentially leak sensitive kernel memory contents through information disclosure vulnerabilities. More critically, depending on how subsequent operations utilize these parsed values or if write paths are involved in related processing logic, there is a risk of heap corruption or arbitrary code execution. The vulnerability stems from improper validation of user-controlled or firmware-provided data structures before arithmetic operations that determine buffer boundaries, which aligns with CWE-190 Integer Overflow or Wraparound and CWE-20 Improper Input Validation. In the context of attack patterns, this flaw facilitates exploitation techniques categorized under ATT&CK T1564 Hidden Elements, as it allows for memory access outside intended limits without immediate detection by standard bounds checking mechanisms.
To mitigate this vulnerability, developers must implement strict boundary checks before performing any arithmetic that determines buffer sizes or offsets. The fix involves computing the fixed extent based on whether a normal or background scan response is selected and explicitly validating that both the fixed fields and the BSS data fit within the total response size reported by the firmware. Only after confirming that resp->size is greater than or equal to the sum of these components should the TLV buffer size be derived and passed to the parser. This ensures that tlv_buf_size remains a valid, non-negative value that respects memory safety constraints. System administrators should apply kernel updates containing this patch immediately to prevent potential exploitation by local attackers with access to wireless interface controls or remote actors capable of influencing firmware response structures through compromised network environments.