CVE-2026-98889

What it actually does

The flaw permits oversized information elements to be copied into a fixed-size probe request buffer in the scheduled scan path before length validation occurs, enabling a buffer overflow in the iwlwifi driver.

Why it matters to the business

Local attackers could escalate privileges or cause system crashes on Linux devices using affected Intel wireless hardware, potentially disrupting operations and requiring urgent patching across fleets with wireless connectivity.

How an attack unfolds

An attacker with local access initiates a scheduled scan containing oversized IEs via userspace tools; the probe request is constructed before the size validation check, allowing the overflow to corrupt kernel memory and achieve code execution.

How to fix it

Apply the upstream kernel fix that relocates probe request construction after the size validation check and correctly advertises maximum scheduled scan IE length to userspace; reboot after updating to the patched kernel version.

How to confirm the fix worked

Confirm the kernel source includes the reordered call to build_scan_probe after the fits check and verify that max_sched_scan_ie_len is set via the max_scan_ie_len helper; test scheduled scans with large IEs to ensure they are rejected before buffer copy.

Typical attack path

1. Obtain local user access on a target Linux system
2. Trigger a scheduled scan request with oversized information elements
3. Bypass the missing length check in the scan preparation path
4. Trigger buffer overflow to corrupt kernel structures
5. Escalate to kernel-level code execution

How to detect it

Inspect kernel logs and dmesg for iwlwifi scan buffer errors, crashes during scheduled scans, or oversized IE warnings; correlate with audit logs showing local scan requests from untrusted processes.

What your security team should do

• Expedite kernel updates on all systems using iwlwifi drivers due to recent disclosure
• Restrict local user accounts and scheduled scan capabilities where feasible
• Monitor kernel logs for iwlwifi scan-related crashes or anomalies
• Review wireless driver configurations to enforce IE size limits