What’s Vulnerable › Vulnerabilities

CVE-2026-98185: wifi: mwifiex: validate scan response extents

• Severity: unknown
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-06 · updated 2026-10-19

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: validate scan response extents mwifiex_ret_802_11_scan() subtracts the fixed response fields and the firmware-provided BSS length from resp->size without first proving that either extent fits. A short response or oversized BSS length can therefore underflow tlv_buf_size and make the TLV parser walk beyond the command response. Compute the fixed extent from the selected normal or background scan response. Validate that the fixed fields and BSS data fit before deriving the TLV extent and entering the parser.

Affected products

• Linux kernel: 3.0 — fixed in 7.3

How to fix

Upgrade to a fixed version: Linux kernel 7.3. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/25217c5f6ce0bf3004f80c129464cd35fe9a420f
• https://git.kernel.org/stable/c/3687d7d48070838cc2953431b3a27717cab0aaf6
• https://git.kernel.org/stable/c/48312f0085aa1577d6d41af2a079b34de17c1a57
• https://git.kernel.org/stable/c/7106ad8b74f50cca1ef36131f327d2c78f556daa
• https://git.kernel.org/stable/c/9cff2f39ed38a32070b08364c4c9346e85b8f9ec
• https://git.kernel.org/stable/c/c4943323fda22ef27bb6479b9d328ae48c63f64c
• https://git.kernel.org/stable/c/cb0008480ed7d5cf76f3ad9668a91bbb7d0b4417
• https://git.kernel.org/stable/c/dccf5ecaad4d8d43c545921f20328e8f91af8698

Get alerted when CVE-2026-98185 or the next vulnerability affects your stack