In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix sched scan IE sizing Scheduled scan built the probe… (CVE-2026-98889)

The vulnerability in the Linux kernel's iwlwifi driver (CVE-2026-98889) was due to the scheduled scan feature building the probe request before the length validation function iwl_mvm_scan_fits() was called. This sequencing allowed oversized information elements (IEs) to be copied into a fixed-size probe request buffer, potentially leading to buffer overflow or memory corruption. The fix involves moving the function iwl_mvm_build_scan_probe() to occur after the length validation check and advertising the maximum allowed scheduled scan IE length to userspace, ensuring that userspace limits account for driver-inserted bytes such as DS and TPC.

The vulnerability could allow oversized IEs to be copied into a fixed buffer, which may lead to memory corruption or instability in the wireless driver. No known exploits are reported in the wild. The impact is limited to the iwlwifi driver in the Linux kernel during scheduled scans.

A fix has been implemented in the Linux kernel to address this vulnerability by reordering the probe request building after length validation and advertising the maximum scheduled scan IE length to userspace. Users should update their Linux kernel to a version that includes this fix. Since no patch links or specific versions are provided, check the official Linux kernel advisories or vendor updates for the patched versions.