Out-of-bounds read in Linux kernel - CVE-2026-98349

Vulnerability details

The vulnerability allows a remote attacker to trigger reads beyond the allocated receive buffer.

The vulnerability exists due to an out-of-bounds read in libipw_network_init() and libipw_parse_info_param() when processing beacon or probe response frames shorter than the required 36-byte prefix. A remote attacker can send a specially crafted wireless management frame to trigger reads beyond the allocated receive buffer.

A 24-byte frame causes the information element length calculation to wrap and truncate to 65524, making the parser treat the buffer as containing almost 64 KiB of information elements.

Affected software

How to mitigate CVE-2026-98349

External References

• https://git.kernel.org/stable/c/14ae269c1306053ddf1ccf37c4bd66e085a652d1
• https://git.kernel.org/stable/c/19959fb60228f6dccc40d55507f8b1a751c2dc89
• https://git.kernel.org/stable/c/23afeb5d2bdfd34c8a0a661876291a4fa9978293
• https://git.kernel.org/stable/c/2c87bbc00dc93149d1dc4f803ad92d92e4ef3758
• https://git.kernel.org/stable/c/5ce5721e8cbe3e80db8f43851cc2a2a92485ef4b
• https://git.kernel.org/stable/c/89959ff00a978f3172726d3d5f861ee6f1aae26d
• https://git.kernel.org/stable/c/cee6f141b3bebe62eb0363fd147acb52023935f0
• https://git.kernel.org/stable/c/ff756e6647722b7d225d882f7bdb186d8eee318e

Related Security Bulletins

• Out-of-bounds read in Linux kernel intel ipw2x00 driver
• Debian update for linux