GHSA-H95C-5QHW-XC7V
Vulnerability from github – Published: 2026-10-18 18:31 – Updated: 2026-10-18 18:31In the Linux kernel, the following vulnerability has been resolved:
iio: proximity: aw96103: validate firmware data length
The firmware parser reads a length from the binary header and then uses it to walk six-byte register/value entries. A truncated firmware image can make the parser read beyond the copied firmware buffer. A value smaller than the four-byte count field also underflows, producing a very large length.
Read the little-endian field with get_unaligned_le32(), as previously proposed by David Lechner. Validate the header size, reject an underflowed length, ensure the resulting payload is contained in the firmware image, and require it to contain whole register/value entries.
{
"affected": [],
"aliases": [
"CVE-2026-98658"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-18T16:17:19Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: proximity: aw96103: validate firmware data length\n\nThe firmware parser reads a length from the binary header and then uses\nit to walk six-byte register/value entries. A truncated firmware image\ncan make the parser read beyond the copied firmware buffer. A value\nsmaller than the four-byte count field also underflows, producing a very\nlarge length.\n\nRead the little-endian field with get_unaligned_le32(), as previously\nproposed by David Lechner. Validate the header size, reject an\nunderflowed length, ensure the resulting payload is contained in the\nfirmware image, and require it to contain whole register/value entries.",
"id": "GHSA-h95c-5qhw-xc7v",
"modified": "2026-10-18T18:31:58Z",
"published": "2026-10-18T18:31:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98658"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1a7c522a35477d70320bd64aba8e9de0c1058c6f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4a9b9f2d4e26589afd0ac099c8e5593170dd5ac7"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6501b032be217ecf47e793b78a05078cf0b604ad"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/815ae0b73b69ace207b6bbf7ef428b06491c3ddb"
}
],
"schema_version": "1.4.0",
"severity": []
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.