CVE-2026-98349

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

wifi: libipw: reject too-short beacon and probe responses

libipw_process_probe_response() and the libipw_network_init() call it

makes assume the frame contains the full 36-byte beacon and probe

response prefix, but the ipw2100 and ipw2200 receive paths only

establish that a management frame carries the generic 24-byte

three-address header.

libipw_network_init() then computes the information element length as

stats->len - sizeof(*beacon)

stats->len is a u16 and sizeof() has type size_t, so the subtraction is

evaluated as size_t and wraps instead of going negative. Truncating

that to the u16 length parameter of libipw_parse_info_param() yields

65524 for a 24-byte beacon, and the parser then walks the receive

buffer as if it held almost 64 KiB of information elements, reading

past the allocation.

Reject the frame before any fixed field is touched.

Found by an AI-assisted review of length arithmetic in management

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References