CVE-2026-98830 wifi: wfx: validate MIB read length before copying to caller

In the Linux kernel, the following vulnerability has been resolved: wifi: wfx: validate MIB read length before copying to caller wfxhifreadmib copies reply-length bytes from the firmware response into the caller-provided buffer without checking that reply-length does not exceed vallen. A firmware...

CVE-2026-98830

The Linux kernel contains a vulnerability in the wifi: wfx component. The function wfx_hif_read_mib() fails to validate that the reply->length from a firmware response does not exceed the val_len of the caller-provided buffer. This lack of bounds checking allows a firmware response with an ove...

EUVD-2026-103770

In the Linux kernel, the following vulnerability has been resolved: wifi: wfx: validate MIB read length before copying to caller wfxhifreadmib copies reply-length bytes from the firmware response into the caller-provided buffer without checking that reply-length does not exceed vallen. A firmware...