CVE-2026-98830

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98830", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.372Z", "datePublished": "2026-10-18T15:49:31.843Z", "dateUpdated": "2026-10-30T12:40:02.347Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:40:02.347Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wfx: validate MIB read length before copying to caller\n\nwfx_hif_read_mib() copies reply->length bytes from the firmware\nresponse into the caller-provided buffer without checking that\nreply->length does not exceed val_len. A firmware response with\na length field larger than expected overruns the caller buffer and\nreads past the end of the reply allocation.\n\nReplace the dead -ENOMEM check with an active validation that\nreply->length fits within val_len before the memcpy."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/silabs/wfx/hif_tx.c"], "versions": [{"version": "f95a29d40782f4f0052a692a822de3ba044b19ff", "lessThan": "b8310b55e53622a393d14af4939f620c1828778b", "status": "affected", "versionType": "git"}, {"version": "f95a29d40782f4f0052a692a822de3ba044b19ff", "lessThan": "819d4c1323e2a9b7329021d5367aa01add22b5dc", "status": "affected", "versionType": "git"}, {"version": "f95a29d40782f4f0052a692a822de3ba044b19ff", "lessThan": "02886c18a340da59df57365f29009e1258bfe333", "status": "affected", "versionType": "git"}, {"version": "f95a29d40782f4f0052a692a822de3ba044b19ff", "lessThan": "71d140099165de03128c00dd129f1eab21c6a3c4", "status": "affected", "versionType": "git"}, {"version": "f95a29d40782f4f0052a692a822de3ba044b19ff", "lessThan": "7acb36fd60a3e7b858f12e69a919c3609b281408", "status": "affected", "versionType": "git"}, {"version": "f95a29d40782f4f0052a692a822de3ba044b19ff", "lessThan": "ce67ebe9d8629776ce38e6995ae72fb903c828db", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/silabs/wfx/hif_tx.c"], "versions": [{"version": "5.5", "status": "affected"}, {"version": "0", "lessThan": "5.5", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.56", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "6.12.113"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "6.18.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b8310b55e53622a393d14af4939f620c1828778b"}, {"url": "https://git.kernel.org/stable/c/819d4c1323e2a9b7329021d5367aa01add22b5dc"}, {"url": "https://git.kernel.org/stable/c/02886c18a340da59df57365f29009e1258bfe333"}, {"url": "https://git.kernel.org/stable/c/71d140099165de03128c00dd129f1eab21c6a3c4"}, {"url": "https://git.kernel.org/stable/c/7acb36fd60a3e7b858f12e69a919c3609b281408"}, {"url": "https://git.kernel.org/stable/c/ce67ebe9d8629776ce38e6995ae72fb903c828db"}], "title": "wifi: wfx: validate MIB read length before copying to caller", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/wireless/silabs/wfx/hif_tx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b8310b55e53622a393d14af4939f620c1828778b", "status": "affected", "version": "f95a29d40782f4f0052a692a822de3ba044b19ff", "versionType": "git"}, {"lessThan": "819d4c1323e2a9b7329021d5367aa01add22b5dc", "status": "affected", "version": "f95a29d40782f4f0052a692a822de3ba044b19ff", "versionType": "git"}, {"lessThan": "02886c18a340da59df57365f29009e1258bfe333", "status": "affected", "version": "f95a29d40782f4f0052a692a822de3ba044b19ff", "versionType": "git"}, {"lessThan": "71d140099165de03128c00dd129f1eab21c6a3c4", "status": "affected", "version": "f95a29d40782f4f0052a692a822de3ba044b19ff", "versionType": "git"}, {"lessThan": "7acb36fd60a3e7b858f12e69a919c3609b281408", "status": "affected", "version": "f95a29d40782f4f0052a692a822de3ba044b19ff", "versionType": "git"}, {"lessThan": "ce67ebe9d8629776ce38e6995ae72fb903c828db", "status": "affected", "version": "f95a29d40782f4f0052a692a822de3ba044b19ff", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/wireless/silabs/wfx/hif_tx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.5"}, {"lessThan": "5.5", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.113", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.56", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wfx: validate MIB read length before copying to caller\n\nwfx_hif_read_mib() copies reply->length bytes from the firmware\nresponse into the caller-provided buffer without checking that\nreply->length does not exceed val_len. A firmware response with\na length field larger than expected overruns the caller buffer and\nreads past the end of the reply allocation.\n\nReplace the dead -ENOMEM check with an active validation that\nreply->length fits within val_len before the memcpy."}], "id": "CVE-2026-98830", "lastModified": "2026-10-30T13:21:29.410", "metrics": {}, "published": "2026-10-18T16:17:37.250", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/02886c18a340da59df57365f29009e1258bfe333"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/71d140099165de03128c00dd129f1eab21c6a3c4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7acb36fd60a3e7b858f12e69a919c3609b281408"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/819d4c1323e2a9b7329021d5367aa01add22b5dc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b8310b55e53622a393d14af4939f620c1828778b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ce67ebe9d8629776ce38e6995ae72fb903c828db"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Denial of Service via buffer overflow in WFx Wi-Fi driver", "id": "2555224", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555224"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nwifi: wfx: validate MIB read length before copying to caller\nwfx_hif_read_mib() copies reply->length bytes from the firmware\nresponse into the caller-provided buffer without checking that\nreply->length does not exceed val_len. A firmware response with\na length field larger than expected overruns the caller buffer and\nreads past the end of the reply allocation.\nReplace the dead -ENOMEM check with an active validation that\nreply->length fits within val_len before the memcpy.", "A flaw was found in the Linux kernel's Silicon Labs WFx Wi-Fi driver. The driver fails to validate the length of firmware responses during Management Information Base (MIB) queries before copying the data into memory buffers. A compromised or malicious wireless device could supply an oversized response, causing a buffer overflow that leads to memory corruption and a Denial of Service (DoS) via a system crash."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-98830", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}], "public_date": "2026-10-18T15:49:31Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98830\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98830\nhttps://git.kernel.org/stable/c/02886c18a340da59df57365f29009e1258bfe333\nhttps://git.kernel.org/stable/c/71d140099165de03128c00dd129f1eab21c6a3c4\nhttps://git.kernel.org/stable/c/7acb36fd60a3e7b858f12e69a919c3609b281408\nhttps://git.kernel.org/stable/c/ce67ebe9d8629776ce38e6995ae72fb903c828db\nhttps://kernelcve.org/list/?q=CVE-2026-98830"], "statement": "wfx_hif_read_mib trusts the length supplied in a firmware MIB response and passes it to memcpy without verifying that it fits in the caller provided buffer. An oversized response therefore causes both an out of bounds read from the reply allocation and an out of bounds write into adjacent kernel memory. The immediate impact can include kernel memory corruption and a system crash. Depending on the affected caller buffer and adjacent objects, information disclosure or privilege escalation may also be possible, but reliable control of the corrupted data is not established. For the CVSS the PR:L in the paranoid score represents environments where a local service account, container root, or user with delegated wireless administration can reach the relevant driver operations. Typical systems may instead require PR:H to manage the interface or install modified firmware. The issue is not proven to be directly network reachable because ordinary WiFi peers do not normally control firmware generated MIB confirmation lengths. A malicious or compromised device firmware is the clearest supported trigger condition.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f95a29d40782f4f0052a692a822de3ba044b19ff,02886c18a340da59df57365f29009e1258bfe333)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f95a29d40782f4f0052a692a822de3ba044b19ff,71d140099165de03128c00dd129f1eab21c6a3c4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f95a29d40782f4f0052a692a822de3ba044b19ff,7acb36fd60a3e7b858f12e69a919c3609b281408)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[f95a29d40782f4f0052a692a822de3ba044b19ff,ce67ebe9d8629776ce38e6995ae72fb903c828db)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.5"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.5)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.113,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.56,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.10,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T20:30:17.101625+00:00", "updated": "2026-10-23T06:00:13.943340+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}