CVE-2026-98889— wifi: iwlwifi: mvm: fix sched scan IE sizing
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Linux 内核中，以下漏洞已得到修复： wifi: iwlwifi: mvm: 修复调度扫描（sched scan）中信息元素（IE）的尺寸问题 在调用 进行长度校验之前，调度扫描会先构建探测请求（probe request），导致过大的信息元素（IE）可能被复制到固定的探测请求缓冲区中。修复方法是将 函数的调用移至长度校验之后。 此外，通过 函数通告 ，确保用户空间在计算限制时，能够计入驱动程序插入的 DS（DS 参数集）和 TPC（传输功率控制）字节。
Possible ATT&CK Techniques 1 AI
T1210 · Exploitation of Remote ServicesAffected Version Matrix 17
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< f2268060e99f94314b9988dfa17393c2694fa9b2 |
affected |
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 358eca9a898ad4cce7453e9dcfd005d019a2b01f |
affected | ||
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 05f79cea3b15cfe600b205ddcfd51ebee15d908a |
affected | ||
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< a24417478f90e9f1a4ea24cd4b784afccb56fbae |
affected | ||
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 0a63f98e5163a2ec2822dfb691ee5a6094de08ec |
affected | ||
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 4f155d262b31b9b17e0f9856bdabe0968eb4930f |
affected | ||
< 5.15.222 |
affected | ||
< 6.1.189 |
affected | ||
| … +9 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-98889
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
wifi: iwlwifi: mvm: fix sched scan IE sizing
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mvm: fix sched scan IE sizing
Scheduled scan built the probe request before iwl_mvm_scan_fits(),
so oversized IEs could be copied into the fixed preq buffer before
length validation. Move iwl_mvm_build_scan_probe() after the fits
check.
Also advertise max_sched_scan_ie_len using iwl_mvm_max_scan_ie_len()
so userspace limits account for driver-inserted DS/TPC bytes.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-98889
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-98889
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-98889 (2)
Same Patch Batch · Linux · 2026-10-23 · 218 CVEs total
| CVE-2026-98959 | 9.8 CRITICAL | btrfs: fix xattr replace when multiple xattrs are packed in the same item |
| CVE-2026-99078 | 9.8 CRITICAL | net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry |
| CVE-2026-99079 | 9.8 CRITICAL | net/mlx5e: Prevent stale XSK buffer release on refill retry |
| CVE-2026-98870 | 8.8 HIGH | ksmbd: remove stale channels from all sessions on teardown |
| CVE-2026-98988 | 8.8 HIGH | namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE |
| CVE-2026-98981 | 8.8 HIGH | namespace: unhash a dentry before detaching the mounts on it |
| CVE-2026-98980 | 8.8 HIGH | namei: don't reveal overmounted entries in refwalk |
| CVE-2026-99082 | 8.8 HIGH | KVM: x86: Use active memslots for the per-vCPU MMIO cache |
| CVE-2026-99083 | 8.8 HIGH | ksmbd: fix heap out-of-bounds write in krb5_authenticate() |
| CVE-2026-99042 | 8.4 HIGH | io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6 |
| CVE-2026-98978 | 8.4 HIGH | namespace: never expire a locked mount |
| CVE-2026-99064 | 8.1 HIGH | cipso: adjust cached option offsets when removing CIPSO |
| CVE-2026-98968 | 8.1 HIGH | amt: send the relay's General Query directly from the receive path |
| CVE-2026-99054 | 7.8 HIGH | tipc: destroy topsrv workqueues before closing connections |
| CVE-2026-98975 | 7.8 HIGH | xfs: stop exchanging reflink flags when exchanging mappings |
| CVE-2026-98976 | 7.8 HIGH | namespace: keep the lock on a mount that a propagated copy is moved beneath |
| CVE-2026-98945 | 7.8 HIGH | HID: steam: Rearrange teardown sequence |
| CVE-2026-99056 | 7.8 HIGH | strparser: make sure __strp_recv isn't running before tearing down the parser |
| CVE-2026-98899 | 7.8 HIGH | netfilter: ipset: mark the rcu locked areas properly |
| CVE-2026-99050 | 7.8 HIGH | gpio: mpsse: fix race when arming the IRQ poll worker |
Showing top 20 of 218 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-99087
dm-integrity: fix NULL pointer dereference when the 'R' flag -
CVE-2026-99086
dm-integrity: validate the superblock on resume -
CVE-2026-99084
readdir: take no inode lock on an immutable directory -
CVE-2026-99085
sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit -
CVE-2026-99083
ksmbd: fix heap out-of-bounds write in krb5_authenticate()
Same vendor: Linux
-
CVE-2026-99087
dm-integrity: fix NULL pointer dereference when the 'R' flag -
CVE-2026-99086
dm-integrity: validate the superblock on resume -
CVE-2026-99084
readdir: take no inode lock on an immutable directory -
CVE-2026-99085
sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit -
CVE-2026-99083
ksmbd: fix heap out-of-bounds write in krb5_authenticate()