In the Linux kernel, the following vulnerability has been resolved: iio: proximity: aw96103: validate firmware data length The firmware parser reads… (CVE-2026-98658)

The Linux kernel's iio proximity driver for the aw96103 device had a vulnerability in its firmware parser. The parser reads a length field from the binary header and uses it to iterate over six-byte register/value entries. If the firmware image is truncated, the parser could read beyond the copied buffer. Additionally, if the length field underflows (is smaller than the four-byte count field), it results in a very large length value. The fix applies proper reading of the little-endian length field using get_unaligned_le32(), validates the header size, rejects underflowed lengths, and ensures the payload is fully contained within the firmware image and consists of whole register/value entries.

The vulnerability could lead to out-of-bounds memory reads by the firmware parser in the kernel, which may cause kernel crashes or potentially other undefined behavior. No known exploits in the wild have been reported. The impact is limited to the kernel component handling the aw96103 proximity sensor firmware.

A fix has been implemented in the Linux kernel to properly validate the firmware data length and prevent out-of-bounds reads. Users should update to the fixed kernel version once available. No additional mitigation steps are indicated.