CVE-2026-98830
Description
A flaw was found in the Linux kernel's Silicon Labs WFx Wi-Fi driver. The driver fails to validate the length of firmware responses during Management Information Base (MIB) queries before copying the data into memory buffers. A compromised or malicious wireless device could supply an oversized response, causing a buffer overflow that leads to memory corruption and a Denial of Service (DoS) via a system crash.
Statement
wfx_hif_read_mib trusts the length supplied in a firmware MIB response and passes it to memcpy without verifying that it fits in the caller provided buffer. An oversized response therefore causes both an out of bounds read from the reply allocation and an out of bounds write into adjacent kernel memory. The immediate impact can include kernel memory corruption and a system crash. Depending on the affected caller buffer and adjacent objects, information disclosure or privilege escalation may also be possible, but reliable control of the corrupted data is not established. For the CVSS the PR:L in the paranoid score represents environments where a local service account, container root, or user with delegated wireless administration can reach the relevant driver operations. Typical systems may instead require PR:H to manage the interface or install modified firmware. The issue is not proven to be directly network reachable because ordinary WiFi peers do not normally control firmware generated MIB confirmation lengths. A malicious or compromised device firmware is the clearest supported trigger condition.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
