All vulnerabilities
CVE-2026-98889

Linux: wifi: iwlwifi: mvm: fix sched scan IE sizing

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in358eca9a898ad4cce7453e9dcfd005d019a2b01fAlso 05f79cea3b15cfe600b205ddcfd51ebee15d908a, 0a63f98e5163a2ec2822dfb691ee5a6094de08ec and 6 moreCVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 358eca9a898ad4cce7453e9dcfd005d019a2b01fLinuxCVE List
  • 05f79cea3b15cfe600b205ddcfd51ebee15d908aLinuxCVE List
  • 0a63f98e5163a2ec2822dfb691ee5a6094de08ecLinuxCVE List
  • 4f155d262b31b9b17e0f9856bdabe0968eb4930fLinuxCVE List
  • 5.15.222LinuxCVE List
  • 6.1.189LinuxCVE List
Show all 9 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: fix sched scan IE sizing

Scheduled scan built the probe request before iwl_mvm_scan_fits(), so oversized IEs could be copied into the fixed preq buffer before length validation. Move iwl_mvm_build_scan_probe() after the fits check.

Also advertise max_sched_scan_ie_len using iwl_mvm_max_scan_ie_len() so userspace limits account for driver-inserted DS/TPC bytes.

Text from CVE List

Affected versions 17

  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before f2268060e99f94314b9988dfa17393c2694fa9b2CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 358eca9a898ad4cce7453e9dcfd005d019a2b01fCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 05f79cea3b15cfe600b205ddcfd51ebee15d908aCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before a24417478f90e9f1a4ea24cd4b784afccb56fbaeCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 0a63f98e5163a2ec2822dfb691ee5a6094de08ecCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 4f155d262b31b9b17e0f9856bdabe0968eb4930fCVE List
  • Linuxaffected: all versions before 5.15.222CVE List
  • Linuxaffected: all versions before 6.1.189CVE List
  • Linuxaffected: all versions before 6.6.158CVE List
  • Linuxaffected: all versions before 6.12.111CVE List
  • Linuxaffected: all versions before 6.18.53CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2CVE List

References 6