CVE-2026-98186

wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length

Published Oct 6, 2026 CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length

mwifiex_search_oui_in_ie() reads a pairwise-cipher (PTK) count from a
beacon/probe-response RSN or WPA information element and then walks that
many 4-byte OUIs, comparing each with memcmp(). The count comes straight
from the (attacker-supplied) IE and is never checked against the
element's own length, and the callers admit the element on element_id
alone (has_ieee_hdr() / has_vendor_hdr(), no length check). A crafted
RSN/WPA IE with a large pairwise count therefore makes the walk read up
to 255 * 4 bytes past the element -- an out-of-bounds read of the
kmemdup()'d beacon buffer, reachable from any AP whose beacon/probe
response is processed during scan-result parsing.

Pass the number of IE bytes available at the OUI list and bound the walk
to the element. Keep the length signed and reject a negative value
before any unsigned arithmetic, so a small or zero IE length cannot
underflow to a large size_t and defeat the bound.

Found by 0sec automated security-research tooling (https://0sec.ai).

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e`	affected	< 77e642af7f2f6029e12a35c847c56cbd0466e799
`5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e`	affected	< 982b8fcdbb28f63bbbf02f0822c0bbda12ec27ed
`5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e`	affected	< 58767b41f87244eebaa5a475b9d276c83b89b933
`5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e`	affected	< 2402c9e2644b7e10c7aaaf87bf12743d7e363559
`5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e`	affected	< 54a9cc5bd70b0d77a5069d4c46998c679a10c857
`5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e`	affected	< 8bbef2b1ebfbadc0b9c37bbbf9c9e26fe2e41960
`5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e`	affected	< 46cda9d42f0d6ec3057d878ddb1f38c0ab9f51df
`5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e`	affected	< e667aee1c192d67d27c803007bfa9c6e0873e959

Linux

affected

Version	Status	Constraints
`3.0`	affected	—
`0`	unaffected	< 3.0
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.112`	unaffected	≤ 6.12.*
`6.18.54`	unaffected	≤ 6.18.*
`7.2.8`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e,77e642af7f2f6029e12a35c847c56cbd0466e799)`	affected	code_commit	—
`[5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e,982b8fcdbb28f63bbbf02f0822c0bbda12ec27ed)`	affected	code_commit	—
`[5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e,58767b41f87244eebaa5a475b9d276c83b89b933)`	affected	code_commit	—
`[5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e,2402c9e2644b7e10c7aaaf87bf12743d7e363559)`	affected	code_commit	—
`[5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e,54a9cc5bd70b0d77a5069d4c46998c679a10c857)`	affected	code_commit	—
`[5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e,8bbef2b1ebfbadc0b9c37bbbf9c9e26fe2e41960)`	affected	code_commit	—
`[5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e,46cda9d42f0d6ec3057d878ddb1f38c0ab9f51df)`	affected	code_commit	—
`[5e6e3a92b9a4c9416b17f468fa7c7fa2233b8b4e,e667aee1c192d67d27c803007bfa9c6e0873e959)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`3.0`	affected	semver	—
`[0,3.0)`	unaffected	semver	—
`[5.10.271,5.11.0]`	unaffected	semver	—
`[5.15.222,5.16.0]`	unaffected	semver	—
`[6.1.189,6.2.0]`	unaffected	semver	—
`[6.6.158,6.7.0]`	unaffected	semver	—
`[6.12.112,6.13.0]`	unaffected	semver	—
`[6.18.54,6.19.0]`	unaffected	semver	—
`[7.2.8,7.3.0]`	unaffected	semver	—
`[7.3-rc4,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4841-1	linux security update
Debian DLA	DLA-4850-1	linux-6.12 security update
Debian DSA	DSA-6568-1	linux security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9091-1	Linux kernel (NVIDIA Tegra) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.177% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98186.mbox
https://git.kernel.org/stable/c/2402c9e2644b7e10c7aaaf87bf12743d7e363559
https://git.kernel.org/stable/c/46cda9d42f0d6ec3057d878ddb1f38c0ab9f51df
https://git.kernel.org/stable/c/54a9cc5bd70b0d77a5069d4c46998c679a10c857
https://git.kernel.org/stable/c/58767b41f87244eebaa5a475b9d276c83b89b933
https://git.kernel.org/stable/c/77e642af7f2f6029e12a35c847c56cbd0466e799
https://git.kernel.org/stable/c/8bbef2b1ebfbadc0b9c37bbbf9c9e26fe2e41960
https://git.kernel.org/stable/c/982b8fcdbb28f63bbbf02f0822c0bbda12ec27ed
https://git.kernel.org/stable/c/e667aee1c192d67d27c803007bfa9c6e0873e959
https://nvd.nist.gov/vuln/detail/CVE-2026-98186
https://www.cve.org/CVERecord?id=CVE-2026-98186

History

Oct 9, 2026 12:15 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98186.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98186 https://www.cve.org/CVERecord?id=CVE-2026-98186
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Oct 6, 2026 4:15 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-125

Oct 6, 2026 9:00 AM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length mwifiex_search_oui_in_ie() reads a pairwise-cipher (PTK) count from a beacon/probe-response RSN or WPA information element and then walks that many 4-byte OUIs, comparing each with memcmp(). The count comes straight from the (attacker-supplied) IE and is never checked against the element's own length, and the callers admit the element on element_id alone (has_ieee_hdr() / has_vendor_hdr(), no length check). A crafted RSN/WPA IE with a large pairwise count therefore makes the walk read up to 255 * 4 bytes past the element -- an out-of-bounds read of the kmemdup()'d beacon buffer, reachable from any AP whose beacon/probe response is processed during scan-result parsing. Pass the number of IE bytes available at the OUI list and bound the walk to the element. Keep the length signed and reject a negative value before any unsigned arithmetic, so a small or zero IE length cannot underflow to a large size_t and defeat the bound. Found by 0sec automated security-research tooling (https://0sec.ai).
Title		wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2402c9e2644b7e10c7aaaf87bf12743d7e363559 https://git.kernel.org/stable/c/46cda9d42f0d6ec3057d878ddb1f38c0ab9f51df https://git.kernel.org/stable/c/54a9cc5bd70b0d77a5069d4c46998c679a10c857 https://git.kernel.org/stable/c/58767b41f87244eebaa5a475b9d276c83b89b933 https://git.kernel.org/stable/c/77e642af7f2f6029e12a35c847c56cbd0466e799 https://git.kernel.org/stable/c/8bbef2b1ebfbadc0b9c37bbbf9c9e26fe2e41960 https://git.kernel.org/stable/c/982b8fcdbb28f63bbbf02f0822c0bbda12ec27ed https://git.kernel.org/stable/c/e667aee1c192d67d27c803007bfa9c6e0873e959