VulnerabilityPublished 6 Oct 2026Updated 19 Oct 2026

CVE-2026-98186: Linux kernel · wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in e667aee1c192d67d27c803007bfa9c6e0873e959 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 17:16 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 7% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in e667aee1c192d67d27c803007bfa9c6e0873e959, 58767b41f87244eebaa5a475b9d276c83b89b933, 2402c9e2644b7e10c7aaaf87bf12743d7e363559 +5

Exploitation evidence

Disclosed: evidence found.
CVE published 6 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e, < e667aee1c192d67d27c803007bfa9c6e0873e959	Fixed in e667aee1c192d67d27c803007bfa9c6e0873e959
LinuxLinux	Affected ≥ 5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e, < 58767b41f87244eebaa5a475b9d276c83b89b933	Fixed in 58767b41f87244eebaa5a475b9d276c83b89b933
LinuxLinux	Affected ≥ 5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e, < 2402c9e2644b7e10c7aaaf87bf12743d7e363559	Fixed in 2402c9e2644b7e10c7aaaf87bf12743d7e363559
LinuxLinux	Affected ≥ 5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e, < 982b8fcdbb28f63bbbf02f0822c0bbda12ec27ed	Fixed in 982b8fcdbb28f63bbbf02f0822c0bbda12ec27ed
LinuxLinux	Affected ≥ 5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e, < 77e642af7f2f6029e12a35c847c56cbd0466e799	Fixed in 77e642af7f2f6029e12a35c847c56cbd0466e799
LinuxLinux	Affected ≥ 5e6e3a92b9a4c9416b17f468fa5c7fa2233b8b4e, < 54a9cc5bd70b0d77a5069d4c46998c679a10c857	Fixed in 54a9cc5bd70b0d77a5069d4c46998c679a10c857

AI-suggested

A fix is available and has been applied in the Linux kernel. Users should update to the fixed kernel versions that include the patch identified by the listed commit hashes. No additional mitigation is required once the system is updated.

Description

A vulnerability in the Linux kernel's mwifiex driver allows an out-of-bounds read due to improper bounds checking of the pairwise-cipher OUI count in RSN or WPA information elements. An attacker can craft a beacon or probe response with a large pairwise count, causing the driver to read beyond the allocated buffer during scan-result parsing. This issue has been fixed by bounding the OUI walk to the actual IE length and validating the length to prevent underflow.

Impact

This vulnerability results in an out-of-bounds read in kernel memory during wireless scan processing. While the input does not describe direct exploitation consequences such as privilege escalation or denial of service, out-of-bounds reads can lead to information disclosure or kernel instability. The flaw is exploitable by any access point whose beacon or probe response is processed by the vulnerable driver.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 12:26 UTC

Technical details

References

Community reviews

Related threats