CVE-2026-98889

wifi: iwlwifi: mvm: fix sched scan IE sizing

State: Published
Severity: 7.8 High
Published: Oct 23, 2026
Updated: Oct 26, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: fix sched scan IE sizing

Scheduled scan built the probe request before iwl_mvm_scan_fits(), so oversized IEs could be copied into the fixed preq buffer before length validation. Move iwl_mvm_build_scan_probe() after the fits check.

Also advertise max_sched_scan_ie_len using iwl_mvm_max_scan_ie_len() so userspace limits account for driver-inserted DS/TPC bytes.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	eae94cf82d7456b57fa9fd55c1edb8a726dcc19c to before f2268060e99f94314b9988dfa17393c2694fa9b2Affected eae94cf82d7456b57fa9fd55c1edb8a726dcc19c to before 358eca9a898ad4cce7453e9dcfd005d019a2b01fAffected eae94cf82d7456b57fa9fd55c1edb8a726dcc19c to before 05f79cea3b15cfe600b205ddcfd51ebee15d908aAffected eae94cf82d7456b57fa9fd55c1edb8a726dcc19c to before a24417478f90e9f1a4ea24cd4b784afccb56fbaeAffected eae94cf82d7456b57fa9fd55c1edb8a726dcc19c to before 0a63f98e5163a2ec2822dfb691ee5a6094de08ecAffected eae94cf82d7456b57fa9fd55c1edb8a726dcc19c to before 4f155d262b31b9b17e0f9856bdabe0968eb4930fAffected
LinuxLinux	5.11Affected before 5.11Not affected 5.15.222 through 5.15.Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.111 through 6.12.Not affected 6.18.53 through 6.18.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

eae94cf82d7456b57fa9fd55c1edb8a726dcc19c to before f2268060e99f94314b9988dfa17393c2694fa9b2Affected
eae94cf82d7456b57fa9fd55c1edb8a726dcc19c to before 358eca9a898ad4cce7453e9dcfd005d019a2b01fAffected
eae94cf82d7456b57fa9fd55c1edb8a726dcc19c to before 05f79cea3b15cfe600b205ddcfd51ebee15d908aAffected
eae94cf82d7456b57fa9fd55c1edb8a726dcc19c to before a24417478f90e9f1a4ea24cd4b784afccb56fbaeAffected
eae94cf82d7456b57fa9fd55c1edb8a726dcc19c to before 0a63f98e5163a2ec2822dfb691ee5a6094de08ecAffected
eae94cf82d7456b57fa9fd55c1edb8a726dcc19c to before 4f155d262b31b9b17e0f9856bdabe0968eb4930fAffected

LinuxLinux

5.11Affected
before 5.11Not affected
5.15.222 through 5.15.*Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.111 through 6.12.*Not affected
6.18.53 through 6.18.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.