{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98186", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.323Z", "datePublished": "2026-10-06T08:44:28.429Z", "dateUpdated": "2026-10-19T09:15:17.749Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:15:17.749Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length\n\nmwifiex_search_oui_in_ie() reads a pairwise-cipher (PTK) count from a\nbeacon/probe-response RSN or WPA information element and then walks that\nmany 4-byte OUIs, comparing each with memcmp(). The count comes straight\nfrom the (attacker-supplied) IE and is never checked against the\nelement's own length, and the callers admit the element on element_id\nalone (has_ieee_hdr() / has_vendor_hdr(), no length check). A crafted\nRSN/WPA IE with a large pairwise count therefore makes the walk read up\nto 255 * 4 bytes past the element -- an out-of-bounds read of the\nkmemdup()'d beacon buffer, reachable from any AP whose beacon/probe\nresponse is processed during scan-result parsing.\n\nPass the number of IE bytes available at the OUI list and bound the walk\nto the element. Keep the length signed and reject a negative value\nbefore any unsigned arithmetic, so a small or zero IE length cannot\nunderflow to a large size_t and defeat the bound.\n\nFound by 0sec automated security-research tooling (https://0sec.ai)."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/marvell/mwifiex/scan.c"], "versions": [{"version": "5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e", "lessThan": "77e642af7f2f6029e12a35c847c56cbd0466e799", "status": "affected", "versionType": "git"}, {"version": "5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e", "lessThan": "982b8fcdbb28f63bbbf02f0822c0bbda12ec27ed", "status": "affected", "versionType": "git"}, {"version": "5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e", "lessThan": "58767b41f87244eebaa5a475b9d276c83b89b933", "status": "affected", "versionType": "git"}, {"version": "5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e", "lessThan": "2402c9e2644b7e10c7aaaf87bf12743d7e363559", "status": "affected", "versionType": "git"}, {"version": "5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e", "lessThan": "54a9cc5bd70b0d77a5069d4c46998c679a10c857", "status": "affected", "versionType": "git"}, {"version": "5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e", "lessThan": "8bbef2b1ebfbadc0b9c37bbbf9c9e26fe2e41960", "status": "affected", "versionType": "git"}, {"version": "5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e", "lessThan": "46cda9d42f0d6ec3057d878ddb1f38c0ab9f51df", "status": "affected", "versionType": "git"}, {"version": "5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e", "lessThan": "e667aee1c192d67d27c803007bfa9c6e0873e959", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/wireless/marvell/mwifiex/scan.c"], "versions": [{"version": "3.0", "status": "affected"}, {"version": "0", "lessThan": "3.0", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.54", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.8", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.0", "versionEndExcluding": "5.10.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.0", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.0", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.0", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.0", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.0", "versionEndExcluding": "6.18.54"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.0", "versionEndExcluding": "7.2.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.0", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/77e642af7f2f6029e12a35c847c56cbd0466e799"}, {"url": "https://git.kernel.org/stable/c/982b8fcdbb28f63bbbf02f0822c0bbda12ec27ed"}, {"url": "https://git.kernel.org/stable/c/58767b41f87244eebaa5a475b9d276c83b89b933"}, {"url": "https://git.kernel.org/stable/c/2402c9e2644b7e10c7aaaf87bf12743d7e363559"}, {"url": "https://git.kernel.org/stable/c/54a9cc5bd70b0d77a5069d4c46998c679a10c857"}, {"url": "https://git.kernel.org/stable/c/8bbef2b1ebfbadc0b9c37bbbf9c9e26fe2e41960"}, {"url": "https://git.kernel.org/stable/c/46cda9d42f0d6ec3057d878ddb1f38c0ab9f51df"}, {"url": "https://git.kernel.org/stable/c/e667aee1c192d67d27c803007bfa9c6e0873e959"}], "title": "wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/wireless/marvell/mwifiex/scan.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "77e642af7f2f6029e12a35c847c56cbd0466e799", "status": "affected", "version": "5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e", "versionType": "git"}, {"lessThan": "982b8fcdbb28f63bbbf02f0822c0bbda12ec27ed", "status": "affected", "version": "5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e", "versionType": "git"}, {"lessThan": "58767b41f87244eebaa5a475b9d276c83b89b933", "status": "affected", "version": "5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e", "versionType": "git"}, {"lessThan": "2402c9e2644b7e10c7aaaf87bf12743d7e363559", "status": "affected", "version": "5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e", "versionType": "git"}, {"lessThan": "54a9cc5bd70b0d77a5069d4c46998c679a10c857", "status": "affected", "version": "5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e", "versionType": "git"}, {"lessThan": "8bbef2b1ebfbadc0b9c37bbbf9c9e26fe2e41960", "status": "affected", "version": "5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e", "versionType": "git"}, {"lessThan": "46cda9d42f0d6ec3057d878ddb1f38c0ab9f51df", "status": "affected", "version": "5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e", "versionType": "git"}, {"lessThan": "e667aee1c192d67d27c803007bfa9c6e0873e959", "status": "affected", "version": "5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/wireless/marvell/mwifiex/scan.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.0"}, {"lessThan": "3.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.271", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.54", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length\n\nmwifiex_search_oui_in_ie() reads a pairwise-cipher (PTK) count from a\nbeacon/probe-response RSN or WPA information element and then walks that\nmany 4-byte OUIs, comparing each with memcmp(). The count comes straight\nfrom the (attacker-supplied) IE and is never checked against the\nelement's own length, and the callers admit the element on element_id\nalone (has_ieee_hdr() / has_vendor_hdr(), no length check). A crafted\nRSN/WPA IE with a large pairwise count therefore makes the walk read up\nto 255 * 4 bytes past the element -- an out-of-bounds read of the\nkmemdup()'d beacon buffer, reachable from any AP whose beacon/probe\nresponse is processed during scan-result parsing.\n\nPass the number of IE bytes available at the OUI list and bound the walk\nto the element. Keep the length signed and reject a negative value\nbefore any unsigned arithmetic, so a small or zero IE length cannot\nunderflow to a large size_t and defeat the bound.\n\nFound by 0sec automated security-research tooling (https://0sec.ai)."}], "id": "CVE-2026-98186", "lastModified": "2026-10-19T10:18:18.940", "metrics": {}, "published": "2026-10-06T09:18:03.540", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2402c9e2644b7e10c7aaaf87bf12743d7e363559"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/46cda9d42f0d6ec3057d878ddb1f38c0ab9f51df"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/54a9cc5bd70b0d77a5069d4c46998c679a10c857"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/58767b41f87244eebaa5a475b9d276c83b89b933"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/77e642af7f2f6029e12a35c847c56cbd0466e799"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8bbef2b1ebfbadc0b9c37bbbf9c9e26fe2e41960"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/982b8fcdbb28f63bbbf02f0822c0bbda12ec27ed"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e667aee1c192d67d27c803007bfa9c6e0873e959"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length", "id": "2546474", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546474"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in the Linux kernel's mwifiex Wi-Fi driver. A nearby wireless attacker can exploit this vulnerability by broadcasting crafted Wi-Fi beacon or probe response frames containing an excessively large pairwise cipher count. Because the driver fails to validate this count against the frame element's actual length, it reads beyond the allocated buffer while processing scan results. This issue can cause a system crash, leading to a Denial of Service (DoS), or potentially disclose adjacent kernel memory."], "name": "CVE-2026-98186", "public_date": "2026-10-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98186\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98186\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98186.mbox"], "threat_severity": "Moderate"}