CVE-2026-98830
Received Received - Intake

Buffer Overread in Linux Kernel WiFi Driver wfx

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: wifi: wfx: validate MIB read length before copying to caller wfx_hif_read_mib() copies reply->length bytes from the firmware response into the caller-provided buffer without checking that reply->length does not exceed val_len. A firmware response with a length field larger than expected overruns the caller buffer and reads past the end of the reply allocation. Replace the dead -ENOMEM check with an active validation that reply->length fits within val_len before the memcpy.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98830
EUVD
EUVD-2026-103770

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux f95a29d40782f4f0052a692a822de3ba044b19ff
Linux Linux f95a29d40782f4f0052a692a822de3ba044b19ff
Linux Linux f95a29d40782f4f0052a692a822de3ba044b19ff
Linux Linux f95a29d40782f4f0052a692a822de3ba044b19ff
Linux Linux 5.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Linux kernel's wifi driver (wfx). It involves a buffer overrun where the function wfx_hif_read_mib() copies data from firmware responses into a caller-provided buffer without verifying the response length. If the firmware sends a response with a length larger than expected, it overwrites memory beyond the allocated buffer.

Detection Guidance

This vulnerability affects the Linux kernel's wfx WiFi driver. Detection requires checking if your system uses a vulnerable kernel version with the wfx driver. Inspect kernel logs for buffer overrun errors or unusual WiFi driver behavior. Commands like dmesg | grep wfx or journalctl -k | grep wfx may help identify issues.

Impact Analysis

This flaw could allow an attacker with access to the system to cause memory corruption, potentially leading to crashes, data corruption, or privilege escalation. It may also enable unauthorized code execution if exploited.

Mitigation Strategies

Update your Linux kernel to a patched version that includes the fix for CVE-2026-98830. If using a distribution kernel, apply available security updates. For custom kernels, rebuild with the patch that validates reply->length before memcpy in wfx_hif_read_mib().

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98830. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart