CVE-2026-98348

Description

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short association responses libipw_handle_assoc_resp() reads the capability, status and aid fields of the 30-byte association response prefix and then computes the information element length as stats->len - sizeof(*frame) stats->len is a u16 and sizeof() has type size_t, so the subtraction is evaluated as size_t and wraps instead of going negative. Truncating that to the u16 length parameter of libipw_parse_info_param() turns a frame shorter than the fixed fields into a length near 64 KiB, and the parser then reads past the receive buffer. Both the ipw2100 and ipw2200 management receive paths reach this function having established only that the frame carries the generic 24-byte three-address header. Reject the frame before any fixed field is touched. Found by an AI-assisted review of length arithmetic in management frame parsers. Verified with a KUnit case under Generic KASAN on arm64 under QEMU; I do not have the hardware, so it is not tested on a real device.

Is your site exposed to CVE-2026-98348?

Run a free security scan — no signup, results in seconds.

EPSS — Exploit Prediction

0.0017

Probability of exploitation

0.06%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/14cb425ba1f3a5d849e3bbc3d02d84e0ae195dbb https://git.kernel.org/stable/c/400b89217058fac672134a0d4092c8493dadb8ad https://git.kernel.org/stable/c/46aa75291056b6dc5faaf956dffdb3e9662477b0 https://git.kernel.org/stable/c/766268b429ae26d8ca599031fa962b0fe4673120 https://git.kernel.org/stable/c/adb7118b7d2cfd7e8213c17d7d2829f353017754 https://git.kernel.org/stable/c/af1b69be19c34e28c0ae54bee954b58cd076969a https://git.kernel.org/stable/c/d70bdb84cf1782039384c1ffa7a18b0303c286a7 https://git.kernel.org/stable/c/e3025ecdb2057f866c09e059fc1466e81d6f243e

Frequently Asked Questions

What is CVE-2026-98348? +

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short association responses libipw_handle_assoc_resp() reads the capability, status and aid fields of the 30-byte association response prefix and then computes the information element length as stats->len - sizeof(*frame) stats->len is a u16 and sizeof() has type size_t, so the subtraction is evaluated as size_t and wraps instead of going negative. Truncating that to the u16 length parameter of libipw_parse_info_param() turns a frame shorter than the fixed fields into a length near 64 KiB, and the parser then reads past the receive buffer. Both the ipw2100 and ipw2200 management receive paths reach this function having established only that the frame carries the generic 24-byte three-address header. Reject the frame before any fixed field is touched. Found by an AI-assisted review of length arithmetic in management frame parsers. Verified with a KUnit case under Generic KASAN on arm64 under QEMU; I do not have the hardware, so it is not tested on a real device.

How do I check if I'm vulnerable to CVE-2026-98348? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.