Riskcovery

CVE-2026-98830

wifi: wfx: validate MIB read length before copying to caller

State
Published
Severity
Not scored
Published
Oct 18, 2026
Updated
Oct 30, 2026
Reserved
Sep 25, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: wfx: validate MIB read length before copying to caller

wfx_hif_read_mib() copies reply->length bytes from the firmware response into the caller-provided buffer without checking that reply->length does not exceed val_len. A firmware response with a length field larger than expected overruns the caller buffer and reads past the end of the reply allocation.

Replace the dead -ENOMEM check with an active validation that reply->length fits within val_len before the memcpy.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • f95a29d40782f4f0052a692a822de3ba044b19ff to before b8310b55e53622a393d14af4939f620c1828778bAffected
  • f95a29d40782f4f0052a692a822de3ba044b19ff to before 819d4c1323e2a9b7329021d5367aa01add22b5dcAffected
  • f95a29d40782f4f0052a692a822de3ba044b19ff to before 02886c18a340da59df57365f29009e1258bfe333Affected
  • f95a29d40782f4f0052a692a822de3ba044b19ff to before 71d140099165de03128c00dd129f1eab21c6a3c4Affected
  • f95a29d40782f4f0052a692a822de3ba044b19ff to before 7acb36fd60a3e7b858f12e69a919c3609b281408Affected
  • f95a29d40782f4f0052a692a822de3ba044b19ff to before ce67ebe9d8629776ce38e6995ae72fb903c828dbAffected
LinuxLinux
  • 5.5Affected
  • before 5.5Not affected
  • 6.1.191 through 6.1.*Not affected
  • 6.6.160 through 6.6.*Not affected
  • 6.12.113 through 6.12.*Not affected
  • 6.18.56 through 6.18.*Not affected
  • 7.2.10 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.