{"schema":"threatline.record/2","record":{"id":"CVE-2026-98186","aliases":[],"summary":"wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length\n\nmwifiex_search_oui_in_ie() reads a pairwise-cipher (PTK) count from a\nbeacon/probe-response RSN or WPA information element and then walks that\nmany 4-byte OUIs, comparing each with memcmp(). The count comes straight\nfrom the (attacker-supplied) IE and is never checked against the\nelement's own length, and the callers admit the element on element_id\nalone (has_ieee_hdr() / has_vendor_hdr(), no length check). A crafted\nRSN/WPA IE with a large pairwise count therefore makes the walk read up\nto 255 * 4 bytes past the element -- an out-of-bounds read of the\nkmemdup()'d beacon buffer, reachable from any AP whose beacon/probe\nresponse is processed during scan-result parsing.\n\nPass the number of IE bytes available at the OUI list and bound the walk\nto the element. Keep the length signed and reject a negative value\nbefore any unsigned arithmetic, so a small or zero IE length cannot\nunderflow to a large size_t and defeat the bound.\n\nFound by 0sec automated security-research tooling (https://0sec.ai).","categories":["Operating systems"],"product":"Linux","vendor":"Linux","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98186","source_modified_at":"2026-10-19T09:15:17.749Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e","lessThan":"77e642af7f2f6029e12a35c847c56cbd0466e799","status":"affected","versionType":"git"},{"version":"5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e","lessThan":"982b8fcdbb28f63bbbf02f0822c0bbda12ec27ed","status":"affected","versionType":"git"},{"version":"5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e","lessThan":"58767b41f87244eebaa5a475b9d276c83b89b933","status":"affected","versionType":"git"},{"version":"5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e","lessThan":"2402c9e2644b7e10c7aaaf87bf12743d7e363559","status":"affected","versionType":"git"},{"version":"5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e","lessThan":"54a9cc5bd70b0d77a5069d4c46998c679a10c857","status":"affected","versionType":"git"},{"version":"5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e","lessThan":"8bbef2b1ebfbadc0b9c37bbbf9c9e26fe2e41960","status":"affected","versionType":"git"},{"version":"5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e","lessThan":"46cda9d42f0d6ec3057d878ddb1f38c0ab9f51df","status":"affected","versionType":"git"},{"version":"5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e","lessThan":"e667aee1c192d67d27c803007bfa9c6e0873e959","status":"affected","versionType":"git"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98186","source_modified_at":"2026-10-19T09:15:17.749Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"3.0","status":"affected"},{"version":"0","lessThan":"3.0","status":"unaffected","versionType":"semver"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.54","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98186","source_modified_at":"2026-10-19T09:15:17.749Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"77e642af7f2f6029e12a35c847c56cbd0466e799","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98186","source_modified_at":"2026-10-19T09:15:17.749Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"982b8fcdbb28f63bbbf02f0822c0bbda12ec27ed","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98186","source_modified_at":"2026-10-19T09:15:17.749Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"58767b41f87244eebaa5a475b9d276c83b89b933","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98186","source_modified_at":"2026-10-19T09:15:17.749Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"2402c9e2644b7e10c7aaaf87bf12743d7e363559","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98186","source_modified_at":"2026-10-19T09:15:17.749Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"54a9cc5bd70b0d77a5069d4c46998c679a10c857","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98186","source_modified_at":"2026-10-19T09:15:17.749Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"8bbef2b1ebfbadc0b9c37bbbf9c9e26fe2e41960","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98186","source_modified_at":"2026-10-19T09:15:17.749Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"46cda9d42f0d6ec3057d878ddb1f38c0ab9f51df","basis":"first unaffected version stated in the CVE record"}],"cvss":null,"severity":null,"kev":{"listed":false},"epss":{"probability":0.00184,"percentile":0.07618,"score_date":"2026-10-23"},"published_at":"2026-10-06T08:44:28.429Z","modified_at":"2026-10-19T09:15:17.749Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-98186","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-19T09:15:17.749Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98186","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://git.kernel.org/stable/c/77e642af7f2f6029e12a35c847c56cbd0466e799"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/982b8fcdbb28f63bbbf02f0822c0bbda12ec27ed"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/58767b41f87244eebaa5a475b9d276c83b89b933"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/2402c9e2644b7e10c7aaaf87bf12743d7e363559"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/54a9cc5bd70b0d77a5069d4c46998c679a10c857"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/8bbef2b1ebfbadc0b9c37bbbf9c9e26fe2e41960"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/46cda9d42f0d6ec3057d878ddb1f38c0ab9f51df"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/e667aee1c192d67d27c803007bfa9c6e0873e959"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-19T09:15:17.749Z","content_hash":"991d36d00b07c3f556029ffa1a49b4dccac57b5bdb5cbb9a8b0e481dd8268b20"}}