All vulnerabilities
CVE-2026-98658

Linux: iio: proximity: aw96103: validate firmware data length

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4a9b9f2d4e26589afd0ac099c8e5593170dd5ac7Also 6501b032be217ecf47e793b78a05078cf0b604ad, 815ae0b73b69ace207b6bbf7ef428b06491c3ddb and 1 moreCVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 4a9b9f2d4e26589afd0ac099c8e5593170dd5ac7LinuxCVE List
  • 6501b032be217ecf47e793b78a05078cf0b604adLinuxCVE List
  • 815ae0b73b69ace207b6bbf7ef428b06491c3ddbLinuxCVE List
  • 1a7c522a35477d70320bd64aba8e9de0c1058c6fLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

iio: proximity: aw96103: validate firmware data length

The firmware parser reads a length from the binary header and then uses it to walk six-byte register/value entries. A truncated firmware image can make the parser read beyond the copied firmware buffer. A value smaller than the four-byte count field also underflows, producing a very large length.

Read the little-endian field with get_unaligned_le32(), as previously proposed by David Lechner. Validate the header size, reject an underflowed length, ensure the resulting payload is contained in the firmware image, and require it to contain whole register/value entries.

Text from CVE List

Affected versions 10

  • Linuxaffected: 07b241262dcad07671c444ca955903325de28e9e before 4a9b9f2d4e26589afd0ac099c8e5593170dd5ac7CVE List
  • Linuxaffected: 07b241262dcad07671c444ca955903325de28e9e before 6501b032be217ecf47e793b78a05078cf0b604adCVE List
  • Linuxaffected: 07b241262dcad07671c444ca955903325de28e9e before 815ae0b73b69ace207b6bbf7ef428b06491c3ddbCVE List
  • Linuxaffected: 07b241262dcad07671c444ca955903325de28e9e before 1a7c522a35477d70320bd64aba8e9de0c1058c6fCVE List
  • Linuxaffected: 6.12CVE List
  • Linuxunaffected: all versions before 6.12CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.56 through 6.18.*CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 4