AZL-110632: CVE-2026-98889 affecting package kernel 6.6.157.1-1

Q: What systems are exposed to this issue?

Systems using the Azure Linux kernel package version 6.6.157.1-1 with Intel iwlwifi hardware and scheduled Wi-Fi scanning are relevant. The issue is in the iwlwifi mvm scheduled-scan path.

Q: What is required to trigger the vulnerable code path?

Scheduled scanning must build a probe request containing oversized information elements. The vulnerable behavior occurs when those elements are copied into the fixed probe-request buffer before the scan-size validation runs.

Q: How can I tell whether the fix is present?

The corrected code validates that the scan fits before building the scan probe request, and reports the maximum scheduled-scan IE length through iwl_mvm_max_scan_ie_len() so userspace accounts for driver-added DS/TPC bytes.

Published Oct 23, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: fix sched scan IE sizing

Scheduled scan built the probe request before iwlmvmscanfits(), so oversized IEs could be copied into the fixed preq buffer before length validation. Move iwlmvmbuildscanprobe() after the fits check.

Also advertise maxschedscanielen using iwlmvmmaxscanielen() so userspace limits account for driver-inserted DS/TPC bytes.

Affected Software

1 affected component

azure-linux/kernel<=6.6.157.1-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Configuration
Advertise max_sched_scan_ie_len using iwl_mvm_max_scan_ie_len() so userspace limits account for driver-inserted DS/TPC bytes.
iwlwifi mvm max_sched_scan_ie_len = iwl_mvm_max_scan_ie_len()

Event History

Oct 23, 2026

Advisory Published

via OSV·12:18 PM

Data Sourced

via OSV·12:18 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-98889

Frequently Asked Questions

What systems are exposed to this issue?

Systems using the Azure Linux kernel package version 6.6.157.1-1 with Intel iwlwifi hardware and scheduled Wi-Fi scanning are relevant. The issue is in the iwlwifi mvm scheduled-scan path.

What is required to trigger the vulnerable code path?

Scheduled scanning must build a probe request containing oversized information elements. The vulnerable behavior occurs when those elements are copied into the fixed probe-request buffer before the scan-size validation runs.

How can I tell whether the fix is present?

The corrected code validates that the scan fits before building the scan probe request, and reports the maximum scheduled-scan IE length through iwl_mvm_max_scan_ie_len() so userspace accounts for driver-added DS/TPC bytes.

AZL-110632: CVE-2026-98889 affecting package kernel 6.6.157.1-1

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What systems are exposed to this issue?

What is required to trigger the vulnerable code path?

How can I tell whether the fix is present?

Company

Resources

Contact

Frequently Asked Questions

What systems are exposed to this issue?

What is required to trigger the vulnerable code path?

How can I tell whether the fix is present?