CVE-2026-98185
In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: validate scan response extents mwifiex_ret_802_11_scan() subtracts the fixed response fields and the firmware-provided BSS length from resp->size without first proving that either extent fits. A short response or oversized BSS length can therefore underflow tlv_buf_size and make the TLV parser walk beyond the command response. Compute the fixed extent from the selected normal or background scan response. Validate that the fixed fields and BSS data fit before deriving the TLV extent and entering the parser.
Affected versions
Linux kernel versions
3.0
and later are affected. Fixed in
5.10.271,
5.15.222,
6.1.189,
6.6.158,
6.12.112,
6.18.54,
7.2.8,
7.3-rc4
and their respective stable series.
References
8 totalFrequently asked questions
-
What is CVE-2026-98185?
CVE-2026-98185 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 3.0 onward and has been patched in 5.10.271, 5.15.222, 6.1.189 and others. CVE-2026-98185 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-98185?
Yes. CVE-2026-98185 has been patched. Fixed versions include 5.10.271, 5.15.222, 6.1.189 and others. If you are running Linux kernel 3.0 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-98185 actively exploited?
No. CVE-2026-98185 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.