---
id: CVE-2026-98185
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: mwifiex: validate scan response extents

  mwifiex_ret_802_11_scan() subtracts the fixed response fields and the
  firmware-provided BSS length from resp->size withou…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  wifi: mwifiex: validate scan response extents

  mwifiex_ret_802_11_scan() subtracts the fixed response fields and the
  firmware-provided BSS length from resp->size withou…
severity: medium
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e <
    25217c5f6ce0bf3004f80c129464cd35fe9a420f
  - >-
    Linux >= 5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e <
    48312f0085aa1577d6d41af2a079b34de17c1a57
  - >-
    Linux >= 5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e <
    dccf5ecaad4d8d43c545921f20328e8f91af8698
  - >-
    Linux >= 5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e <
    c4943323fda22ef27bb6479b9d328ae48c63f64c
  - >-
    Linux >= 5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e <
    cb0008480ed7d5cf76f3ad9668a91bbb7d0b4417
  - >-
    Linux >= 5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e <
    9cff2f39ed38a32070b08364c4c9346e85b8f9ec
  - >-
    Linux >= 5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e <
    7106ad8b74f50cca1ef36131f327d2c78f556daa
  - >-
    Linux >= 5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e <
    3687d7d48070838cc2953431b3a27717cab0aaf6
  - Linux 3.0
published: '2026-10-06'
updated: '2026-10-06'
sourceUpdated: '2026-10-06T09:18:03.380'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98185'
references:
  - url: 'https://git.kernel.org/stable/c/25217c5f6ce0bf3004f80c129464cd35fe9a420f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3687d7d48070838cc2953431b3a27717cab0aaf6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/48312f0085aa1577d6d41af2a079b34de17c1a57'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/7106ad8b74f50cca1ef36131f327d2c78f556daa'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9cff2f39ed38a32070b08364c4c9346e85b8f9ec'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c4943323fda22ef27bb6479b9d328ae48c63f64c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/cb0008480ed7d5cf76f3ad9668a91bbb7d0b4417'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/dccf5ecaad4d8d43c545921f20328e8f91af8698'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98185.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-98185'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2546388'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-98185'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98185'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98185.mbox
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
ingestedAt: '2026-10-06T08:50:17.450Z'
epss: 0.00177
epssPercentile: 0.07181
cvss: 6.2
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-125
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

wifi: mwifiex: validate scan response extents

mwifiex_ret_802_11_scan() subtracts the fixed response fields and the
firmware-provided BSS length from resp->size without first proving that
either extent fits. A short response or oversized BSS length can
therefore underflow tlv_buf_size and make the TLV parser walk beyond the
command response.

Compute the fixed extent from the selected normal or background scan
response. Validate that the fixed fields and BSS data fit before deriving
the TLV extent and entering the parser.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, … · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98185.json)