CVE-2026-98889 in Linux
Summary
by MITRE • 10/23/2026
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mvm: fix sched scan IE sizing
Scheduled scan built the probe request before iwl_mvm_scan_fits(), so oversized IEs could be copied into the fixed preq buffer before length validation. Move iwl_mvm_build_scan_probe() after the fits check.
Also advertise max_sched_scan_ie_len using iwl_mvm_max_scan_ie_len() so userspace limits account for driver-inserted DS/TPC bytes.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in the Linux kernel's wireless networking subsystem, specifically within the Intel Wireless WiFi Next Generation (iwlwifi) Multi-Mode Virtual Module (MVM), stems from a critical ordering error during the construction of scheduled scan probe requests. Scheduled scanning is a power-efficient mechanism that allows the network interface to periodically search for available access points without maintaining an active connection. The core technical flaw lies in the sequence of operations performed by the driver when preparing these probe frames. Specifically, the function responsible for building and populating the Information Elements (IEs) within the probe request was executed before a validation check determined whether the resulting frame would fit into the pre-allocated buffer provided by the hardware or firmware interface. This inversion of logic meant that user-supplied data intended to be included in the scan requests could be copied into a fixed-size memory buffer without first verifying if the total size exceeded available space.
This implementation defect creates a classic heap-based buffer overflow condition, which aligns with CWE-120 (Buffer Copy without Checking Size of Input). By allowing oversized Information Elements to be written into the preq buffer prior to length validation, an attacker who can influence the content or structure of scheduled scan requests could potentially overwrite adjacent memory structures. In a kernel context, such overflows are particularly dangerous as they may lead to arbitrary code execution, privilege escalation, or system instability through kernel panic. The vulnerability exploits the assumption that input data will always conform to expected size constraints before being processed and stored in fixed-size buffers allocated for hardware communication.
The operational impact of this flaw extends beyond simple memory corruption risks. It affects the reliability and security of wireless connectivity on systems relying on iwlwifi drivers, which are common in many modern laptops and embedded devices. An attacker with local access could craft malicious scheduled scan configurations to trigger the buffer overflow, potentially gaining elevated privileges within the operating system. Furthermore, even if exploitation is difficult due to mitigations like Kernel Address Space Layout Randomization (KASLR) or stack canaries, the vulnerability represents a significant security weakness that violates secure coding principles regarding input validation and bounds checking. It also impacts network discovery accuracy because incorrect buffer handling could lead to malformed probe requests being sent out on the air interface, potentially causing interference or denial of service for other wireless clients in proximity.
To mitigate this risk, the resolution involves reordering the execution flow within the iwl_mvm_scan_fits() logic so that size validation occurs before any data copying takes place. This ensures that oversized Information Elements are rejected early in the process, preventing them from ever reaching the fixed preq buffer. Additionally, the fix includes advertising the maximum allowed scan IE length through a dedicated function that accounts for driver-inserted bytes such as DS (Distributed System) and TPC (Transmit Power Control) elements. This adjustment ensures that userspace applications are aware of the true size constraints imposed by the hardware interface, allowing them to truncate or adjust their own input data accordingly before passing it to the kernel driver. From a defense-in-depth perspective, this change aligns with ATT&CK technique T1059 (Command and Scripting Interpreter) prevention strategies by reducing the attack surface for local privilege escalation via malformed system calls related to wireless configuration. System administrators should ensure that their Linux kernels are updated to include patches addressing CVE details associated with iwlwifi scheduled scan IE sizing issues, thereby closing this path for potential exploitation in production environments.