CVE-2026-98349: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-98349 Overview

CVE-2026-98349 is an out-of-bounds read vulnerability in the Linux kernel's libipw wireless support library used by the ipw2100 and ipw2200 Intel wireless drivers. The flaw affects libipw_process_probe_response() and libipw_network_init(), which assume incoming management frames contain the full 36-byte beacon and probe response prefix. The receive paths only validate the generic 24-byte three-address header, allowing a shorter frame to trigger an unsigned integer underflow in length arithmetic. The parser then walks nearly 64 KiB of memory beyond the receive buffer as if it contained information elements.

Critical Impact
An attacker within wireless range can send a crafted short beacon or probe response frame to trigger kernel memory reads past an allocation, resulting in denial of service through kernel panic or potential information disclosure.

Affected Products

Linux kernel ipw2100 wireless driver
Linux kernel ipw2200 wireless driver
Linux kernel libipw wireless support library

Discovery Timeline

2026-10-06 - CVE-2026-98349 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-98349

Vulnerability Analysis

The vulnerability resides in the Linux kernel's legacy Intel PRO/Wireless support code. The ipw2100 and ipw2200 receive paths accept any 802.11 management frame that carries the standard 24-byte three-address header. These frames are then passed to libipw_process_probe_response(), which calls libipw_network_init() to parse beacon and probe response contents.

Both functions assume the frame contains the 36-byte fixed beacon or probe response prefix, which includes the timestamp, beacon interval, and capability information fields. No length check enforces this assumption before the fixed fields are dereferenced.

The vulnerability was identified through an AI-assisted review of length arithmetic in management frame parsers. Verification was performed with a KUnit test case using Generic KASAN on arm64 under QEMU.

Root Cause

The root cause is an unsigned integer underflow [CWE-191] in the information element length calculation. libipw_network_init() computes the IE length as stats->len - sizeof(*beacon). Because stats->len is a u16 and sizeof() yields size_t, the subtraction is evaluated as size_t and wraps to a very large positive value instead of becoming negative.

Truncating that wrapped value to the u16 length parameter of libipw_parse_info_param() yields 65524 for a 24-byte beacon. The parser then walks the receive buffer as if it contained nearly 64 KiB of information elements, producing out-of-bounds reads past the allocation.

Attack Vector

Exploitation requires adjacent network access, meaning the attacker must be within wireless range of a target system using an affected ipw2100 or ipw2200 adapter. The attacker transmits a crafted 802.11 management frame with the three-address header but without the full 36-byte beacon or probe response prefix. No authentication or user interaction is required.

The primary impact is denial of service through kernel panic triggered by the out-of-bounds read. Depending on heap layout, adjacent memory contents may also be processed by the IE parser.

See the upstream fix in Kernel Git Commit 14ae269 and the backports linked in the references for exact source changes.

Detection Methods for CVE-2026-98349

Indicators of Compromise

Unexpected kernel panics or oops messages referencing libipw_parse_info_param, libipw_network_init, or libipw_process_probe_response in dmesg or /var/log/kern.log.
KASAN slab-out-of-bounds reports naming libipw functions on systems with KASAN enabled.
Loss of wireless connectivity on ipw2100 or ipw2200 adapters correlated with the presence of unknown or malformed access points nearby.

Detection Strategies

Inventory endpoints and embedded systems still using ipw2100 or ipw2200 hardware and verify kernel versions against patched stable branches.
Monitor kernel ring buffer output for crashes in wireless management frame parsing functions and forward these events to centralized logging.
Deploy wireless intrusion detection sensors that flag truncated beacon or probe response frames inconsistent with the 802.11 specification.

Monitoring Recommendations

Forward kernel log events to a centralized log pipeline and alert on crash signatures that include libipw symbols.
Correlate wireless adapter resets with nearby rogue access point sightings to identify active exploitation attempts.
Track kernel package versions across the fleet to confirm every affected host has received the stable backport commits.

How to Mitigate CVE-2026-98349

Immediate Actions Required

Apply the latest stable Linux kernel update that includes the libipw length validation fix on all systems using ipw2100 or ipw2200 adapters.
Where patching is delayed, unload the ipw2100 and ipw2200 modules or disable the affected wireless adapters.
Restrict operation of affected devices to trusted wireless environments until the patch is applied.

Patch Information

The upstream fix rejects beacon and probe response frames that are shorter than the full 36-byte fixed prefix before any fixed field is touched. The change has been backported across multiple stable branches. See the following commits for the source-level fix and backports:

Workarounds

Blacklist the ipw2100 and ipw2200 kernel modules on hosts that do not require legacy Intel PRO/Wireless connectivity.
Replace end-of-life Intel PRO/Wireless 2100 and 2200 adapters with modern wireless hardware that uses actively maintained drivers.
Operate affected systems only on physically protected wireless networks until the stable kernel update is deployed.

bash

# Blacklist affected modules until the patched kernel is deployed
echo 'blacklist ipw2100' | sudo tee /etc/modprobe.d/cve-2026-98349.conf
echo 'blacklist ipw2200' | sudo tee -a /etc/modprobe.d/cve-2026-98349.conf
sudo rmmod ipw2200 2>/dev/null
sudo rmmod ipw2100 2>/dev/null
sudo update-initramfs -u