medium · CVSS v3 5.5

CVE-2026-98658

The CVE-2026-98658 flaw in the Linux kernel’s IIO proximity driver allows a malformed firmware image to cause out‑of‑bounds reads during par

Overview

The CVE-2026-98658 flaw in the Linux kernel’s IIO proximity driver allows a malformed firmware image to cause out‑of‑bounds reads during parsing. The vulnerability arises when the firmware length field is under‑validated, enabling a truncated or crafted image to read beyond the buffer. This can lead to information disclosure or potential denial of service.

Description

In the Linux kernel, the following vulnerability has been resolved: iio: proximity: aw96103: validate firmware data length The firmware parser reads a length from the binary header and then uses it to walk six-byte register/value entries. A truncated firmware image can make the parser read beyond the copied firmware buffer. A value smaller than the four-byte count field also underflows, producing a very large length. Read the little-endian field with get_unaligned_le32(), as previously proposed by David Lechner. Validate the header size, reject an underflowed length, ensure the resulting payload is contained in the firmware image, and require it to contain whole register/value entries.

Impact

The flaw can compromise confidentiality by leaking kernel memory contents, integrity by corrupting firmware parsing logic, and availability by causing a crash or hang. System administrators and kernel maintainers are directly impacted, as the vulnerability exists in the core kernel code.

Remediation

Apply the latest kernel patch that validates the firmware header size, rejects underflowed lengths, and ensures all register/value entries are fully contained. Until a patch is available, disable or remove the aw96103 proximity driver or block loading of untrusted firmware images.

Risk context

Severity medium (CVSS 5.5) with no EPSS data. While not immediately critical, the potential for information leakage warrants timely patching.

Affected products

  • Linux kernel

Scores

Severity
medium
CVSS v2
2.1
CVSS v3
5.5
CVSS v4
—
EPSS
—

Linux kernel IIO firmware buffer-overread medium severity aw96103 proximity driver

← All CVEs

Related CVEs

medium

CVE-2026-98723

In the Linux kernel, the following vulnerability has been resolved: nvmet: copy the hostid into the ctrl before creating PR pc_refs Commit 6202783184bf ("nvmet: Improve nvmet_alloc_ctrl() interface and implementation") added a second uuid_copy() of args->hostid near the end of nvmet_alloc_ctrl(), and commit 7b658153f1b8 ("nvmet: Remove duplicate uuid_copy") removed the original copy that sat before nvmet_ctrl_init_pr() instead of the new one. Since then nvmet_ctrl_init_pr() snapshots ctrl->hostid into the per-controller per-namespace reservation refs while the uuid_copy() from the connect data runs later, after the controller is published. The ctrl is allocated with kzalloc(), so every pc_ref created on this path stores the nil UUID. pc_ref->hostid has a single consumer: nvmet_pr_set_ctrl_to_abort() matches it against the preempted registrant's hostid to kill and drain the victim's in-flight I/O for Preempt and Abort. The match can never hit with the nil UUID, so whenever a namespace with reservations enabled exists before a host connects, which includes every reconnect, Preempt and Abort silently degrades into a plain Preempt: the preempting host sees success while the victim's in-flight I/O is still in the air. Copy the hostid where the rest of the connect data is consumed, before the controller is published and before nvmet_ctrl_init_pr() takes its snapshot.

View analysis

medium

CVE-2026-98619

A race condition in the Linux kernel’s ethtool ETHTOOL_TEST ioctl allows an offline self test to tear down and reconfigure a network interface without holding the required rtnl_lock. This can lead to device instability or crashes on ops‑locked drivers. The issue is limited to the ioctl path and affects specific drivers such as fbnic and bnxt.

View analysis

medium

CVE-2026-98622

This CVE involves a benign warning in the Linux kernel's traffic control conntrack action that can be triggered by an unprivileged user to cause a kernel panic when panic_on_warn is enabled. The issue arises when flow_offload_alloc() fails during a conntrack flush race. The patch removes the warning, preventing the panic.

View analysis

medium

CVE-2026-98623

CVE-2026-98623 is a medium‑severity vulnerability in the Linux kernel’s Nouveau driver that allows an out‑of‑bounds read via the debugfs interface. The flaw occurs when an invalid pstate ID is supplied to nvkm_clk_ustate_update, causing a kernel memory read. It can potentially expose sensitive kernel data to privileged users.

View analysis