In the Linux kernel, the following vulnerability has been resolved: wifi: wfx: validate MIB read length before copying to caller wfx_hif_read_mib()… (CVE-2026-98830)

The Linux kernel wifi wfx driver contained a vulnerability in the wfx_hif_read_mib() function where it copied reply->length bytes from a firmware response into a caller-provided buffer without checking that reply->length was within the bounds of the buffer size val_len. If the firmware response contained a length larger than expected, this would cause a buffer over-read beyond the allocated reply memory. The vulnerability was resolved by replacing the ineffective -ENOMEM check with an active validation ensuring reply->length does not exceed val_len before performing the memcpy operation.

This vulnerability could cause a buffer over-read in kernel memory, potentially leading to memory corruption or information disclosure. The exact impact depends on how the corrupted memory is used, but it could affect system stability or security by exposing kernel memory contents or causing crashes.

A fix has been implemented that validates the reply length before copying data, preventing buffer over-read. Users should apply the official Linux kernel update that includes this patch to remediate the vulnerability.