CVE-2026-98889: wifi: iwlwifi: mvm: fix sched scan IE sizing

Published Oct 23, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: fix sched scan IE sizing

Scheduled scan built the probe request before iwlmvmscanfits(), so oversized IEs could be copied into the fixed preq buffer before length validation. Move iwlmvmbuildscanprobe() after the fits check.

Also advertise maxschedscanielen using iwlmvmmaxscanielen() so userspace limits account for driver-inserted DS/TPC bytes.

Affected Software

1 affected component

Linux Linux kernel

Event History

Oct 23, 2026

CVE Published

via MITRE·11:37 AM

Data Sourced

via MITRE·11:37 AM

Description

Frequently Asked Questions

Which Linux systems are in scope?

Systems using the iwlwifi mvm driver are in scope when they use scheduled scanning. The issue concerns scheduled-scan probe request construction, not scanning behavior generally.

What input condition is required to reach the vulnerable path?

Scheduled-scan probe request information elements must be oversized. In the affected logic, those elements could be copied into the fixed probe-request buffer before the size check was performed.

How does the fix change userspace scan-IE limits?

The driver now advertises max_sched_scan_ie_len through iwl_mvm_max_scan_ie_len(). This makes the userspace-visible limit account for DS and TPC bytes inserted by the driver.

CVE-2026-98889: wifi: iwlwifi: mvm: fix sched scan IE sizing

Affected Software

Event History

Frequently Asked Questions

Which Linux systems are in scope?

What input condition is required to reach the vulnerable path?

How does the fix change userspace scan-IE limits?

Company

Resources

Contact

Frequently Asked Questions

Which Linux systems are in scope?

What input condition is required to reach the vulnerable path?

How does the fix change userspace scan-IE limits?