CVE-2026-98658

What it actually does

Improper validation of a length field in an aw96103 proximity sensor firmware binary allows a truncated image to trigger an out-of-bounds read while walking six-byte register/value pairs or an integer underflow that produces an excessively large length, both resulting in reads past the end of the copied firmware buffer.

Why it matters to the business

Kernel-level memory access violations in a device driver can cause system instability, crashes, or local information disclosure on affected Linux systems that load the aw96103 driver with untrusted firmware.

How an attack unfolds

An attacker supplies a maliciously truncated or malformed firmware image to the aw96103 driver; the parser reads an unchecked length from the header, either walks off the end of the buffer or underflows to a huge value, and performs out-of-bounds memory reads that may leak kernel data or trigger faults.

How to fix it

Update to a Linux kernel containing the fix that uses get_unaligned_le32() for the length field, validates the header size, rejects underflows, and enforces that the payload lies entirely within the firmware image and contains only whole six-byte entries.

How to confirm the fix worked

Confirm the presence of the validation logic in the aw96103 firmware parser source or verify that the running kernel version includes the commit resolving the length checks; test with both truncated and underflowing firmware images to ensure they are rejected.

Typical attack path

1. Identify a system exposing the aw96103 proximity sensor driver
2. Obtain or craft a firmware binary with a manipulated or truncated length field in the header
3. Load the firmware through the driver's firmware loading interface
4. Trigger the parser to process the header and walk register/value entries
5. Observe or exploit the resulting out-of-bounds read

How to detect it

Review kernel logs for oops, warnings, or stack traces originating from the aw96103 firmware parser; look for attempts to load firmware files with anomalous sizes in audit or driver logs.

What your security team should do

• Prioritize kernel updates on any systems using the aw96103 driver
• Restrict firmware loading to signed or verified images where the driver supports it
• Monitor for driver-related kernel oops or warnings indicating firmware parsing failures