All vulnerabilities
CVE-2026-98348

Linux: wifi: libipw: reject too-short association responses

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
7.1High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.26%Chance of exploitation activity in the next 30 days, higher than 16% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in766268b429ae26d8ca599031fa962b0fe4673120Also 400b89217058fac672134a0d4092c8493dadb8ad, 46aa75291056b6dc5faaf956dffdb3e9662477b0 and 1 moreCVE List
Published6 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 766268b429ae26d8ca599031fa962b0fe4673120LinuxCVE List
  • 400b89217058fac672134a0d4092c8493dadb8adLinuxCVE List
  • 46aa75291056b6dc5faaf956dffdb3e9662477b0LinuxCVE List
  • 14cb425ba1f3a5d849e3bbc3d02d84e0ae195dbbLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: libipw: reject too-short association responses

libipw_handle_assoc_resp() reads the capability, status and aid fields of the 30-byte association response prefix and then computes the information element length as

stats->len - sizeof(*frame)

stats->len is a u16 and sizeof() has type size_t, so the subtraction is evaluated as size_t and wraps instead of going negative. Truncating that to the u16 length parameter of libipw_parse_info_param() turns a frame shorter than the fixed fields into a length near 64 KiB, and the parser then reads past the receive buffer.

Both the ipw2100 and ipw2200 management receive paths reach this function having established only that the frame carries the generic 24-byte three-address header.

Reject the frame before any fixed field is touched.

Found by an AI-assisted review of length arithmetic in management frame parsers. Verified with a KUnit case under Generic KASAN on arm64 under QEMU; I do not have the hardware, so it is not tested on a real device.

Text from CVE List

Affected versions 18

  • Linuxaffected: 9e8571affd1c54b9638b4ff9844e47aae07310f6 before 766268b429ae26d8ca599031fa962b0fe4673120CVE List
  • Linuxaffected: 9e8571affd1c54b9638b4ff9844e47aae07310f6 before d70bdb84cf1782039384c1ffa7a18b0303c286a7CVE List
  • Linuxaffected: 9e8571affd1c54b9638b4ff9844e47aae07310f6 before 400b89217058fac672134a0d4092c8493dadb8adCVE List
  • Linuxaffected: 9e8571affd1c54b9638b4ff9844e47aae07310f6 before 46aa75291056b6dc5faaf956dffdb3e9662477b0CVE List
  • Linuxaffected: 9e8571affd1c54b9638b4ff9844e47aae07310f6 before e3025ecdb2057f866c09e059fc1466e81d6f243eCVE List
  • Linuxaffected: 9e8571affd1c54b9638b4ff9844e47aae07310f6 before 14cb425ba1f3a5d849e3bbc3d02d84e0ae195dbbCVE List
  • Linuxaffected: 9e8571affd1c54b9638b4ff9844e47aae07310f6 before af1b69be19c34e28c0ae54bee954b58cd076969aCVE List
  • Linuxaffected: 9e8571affd1c54b9638b4ff9844e47aae07310f6 before adb7118b7d2cfd7e8213c17d7d2829f353017754CVE List
  • Linuxaffected: 2.6.15CVE List
  • Linuxunaffected: all versions before 2.6.15CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8