CVE-2026-98185 - Vulnerability Details

- wifi: mwifiex: validate scan response extents

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mwifiex: validate scan response extents

mwifiex_ret_802_11_scan() subtracts the fixed response fields and the
firmware-provided BSS length from resp->size without first proving that
either extent fits. A short response or oversized BSS length can
therefore underflow tlv_buf_size and make the TLV parser walk beyond the
command response.

Compute the fixed extent from the selected normal or background scan
response. Validate that the fixed fields and BSS data fit before deriving
the TLV extent and entering the parser.

Published: 2026-10-06

Score: 7.0 High

EPSS: < 1% Very Low

KEV: No

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e`	affected	< 25217c5f6ce0bf3004f80c129464cd35fe9a420f
`5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e`	affected	< 48312f0085aa1577d6d41af2a079b34de17c1a57
`5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e`	affected	< dccf5ecaad4d8d43c545921f20328e8f91af8698
`5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e`	affected	< c4943323fda22ef27bb6479b9d328ae48c63f64c
`5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e`	affected	< cb0008480ed7d5cf76f3ad9668a91bbb7d0b4417
`5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e`	affected	< 9cff2f39ed38a32070b08364c4c9346e85b8f9ec
`5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e`	affected	< 7106ad8b74f50cca1ef36131f327d2c78f556daa
`5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e`	affected	< 3687d7d48070838cc2953431b3a27717cab0aaf6

Linux

affected

Version	Status	Constraints
`3.0`	affected	—
`0`	unaffected	< 3.0
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.112`	unaffected	≤ 6.12.*
`6.18.54`	unaffected	≤ 6.18.*
`7.2.8`	unaffected	≤ 7.2.*
`7.3-rc4`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e,25217c5f6ce0bf3004f80c129464cd35fe9a420f)`	affected	code_commit	—
`[5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e,48312f0085aa1577d6d41af2a079b34de17c1a57)`	affected	code_commit	—
`[5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e,dccf5ecaad4d8d43c545921f20328e8f91af8698)`	affected	code_commit	—
`[5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e,c4943323fda22ef27bb6479b9d328ae48c63f64c)`	affected	code_commit	—
`[5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e,cb0008480ed7d5cf76f3ad9668a91bbb7d0b4417)`	affected	code_commit	—
`[5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e,9cff2f39ed38a32070b08364c4c9346e85b8f9ec)`	affected	code_commit	—
`[5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e,7106ad8b74f50cca1ef36131f327d2c78f556daa)`	affected	code_commit	—
`[5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e,3687d7d48070838cc2953431b3a27717cab0aaf6)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.0`	affected	semver	—
`[0,3.0)`	unaffected	semver	—
`[5.10.271,5.11.0)`	unaffected	semver	—
`[5.15.222,5.16.0)`	unaffected	semver	—
`[6.1.189,6.2.0)`	unaffected	semver	—
`[6.6.158,6.7.0)`	unaffected	semver	—
`[6.12.112,6.13.0)`	unaffected	semver	—
`[6.18.54,6.19.0)`	unaffected	semver	—
`[7.2.8,7.3.0)`	unaffected	semver	—
`[7.3-rc4,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00184.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98185.mbox
https://git.kernel.org/stable/c/25217c5f6ce0bf3004f80c129464cd35fe9a420f
https://git.kernel.org/stable/c/3687d7d48070838cc2953431b3a27717cab0aaf6
https://git.kernel.org/stable/c/48312f0085aa1577d6d41af2a079b34de17c1a57
https://git.kernel.org/stable/c/7106ad8b74f50cca1ef36131f327d2c78f556daa
https://git.kernel.org/stable/c/9cff2f39ed38a32070b08364c4c9346e85b8f9ec
https://git.kernel.org/stable/c/c4943323fda22ef27bb6479b9d328ae48c63f64c
https://git.kernel.org/stable/c/cb0008480ed7d5cf76f3ad9668a91bbb7d0b4417
https://git.kernel.org/stable/c/dccf5ecaad4d8d43c545921f20328e8f91af8698
https://nvd.nist.gov/vuln/detail/CVE-2026-98185
https://www.cve.org/CVERecord?id=CVE-2026-98185

History

Fri, 09 Oct 2026 04:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-190

Fri, 09 Oct 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98185.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98185 https://www.cve.org/CVERecord?id=CVE-2026-98185
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Tue, 06 Oct 2026 15:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-190

Tue, 06 Oct 2026 09:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: validate scan response extents mwifiex_ret_802_11_scan() subtracts the fixed response fields and the firmware-provided BSS length from resp->size without first proving that either extent fits. A short response or oversized BSS length can therefore underflow tlv_buf_size and make the TLV parser walk beyond the command response. Compute the fixed extent from the selected normal or background scan response. Validate that the fixed fields and BSS data fit before deriving the TLV extent and entering the parser.
Title		wifi: mwifiex: validate scan response extents
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/25217c5f6ce0bf3004f80c129464cd35fe9a420f https://git.kernel.org/stable/c/3687d7d48070838cc2953431b3a27717cab0aaf6 https://git.kernel.org/stable/c/48312f0085aa1577d6d41af2a079b34de17c1a57 https://git.kernel.org/stable/c/7106ad8b74f50cca1ef36131f327d2c78f556daa https://git.kernel.org/stable/c/9cff2f39ed38a32070b08364c4c9346e85b8f9ec https://git.kernel.org/stable/c/c4943323fda22ef27bb6479b9d328ae48c63f64c https://git.kernel.org/stable/c/cb0008480ed7d5cf76f3ad9668a91bbb7d0b4417 https://git.kernel.org/stable/c/dccf5ecaad4d8d43c545921f20328e8f91af8698

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-06T08:44:27.654Z

Updated: 2026-10-06T08:44:27.654Z

Reserved: 2026-09-25T10:25:14.323Z

Link: CVE-2026-98185

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-06T09:18:03.380

Modified: 2026-10-06T09:18:03.380

Link: CVE-2026-98185

Redhat

Severity : Moderate

Publid Date: 2026-10-06T00:00:00Z

Links: CVE-2026-98185 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-09T05:45:20Z

Weaknesses

CWE-125

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object