Linux Kernel CVE-2026-98889

Exploitation requires: (1) a Linux host running the iwlwifi mvm driver, i.e. an Intel wireless adapter using mvm firmware; (2) local access with the privilege needed to start a scheduled scan via the nl80211 scheduled-scan interface (CAP_NET_ADMIN), consistent with the CVSS PR:L; and (3) the ability to supply oversized information elements in that scheduled-scan request so they are copied into the fixed preq buffer before the iwl_mvm_scan_fits() length validation. Limiting factors that reduce realistic risk: the attack is purely LOCAL (not network-reachable), it needs a privileged capability rather than an ordinary unprivileged user, it is confined to systems with the affected Intel hardware/driver, and it is fixed on patched stable kernels. No user interaction is required (UI:N).

This is a high-severity (CVSS 7.8) local kernel memory-corruption flaw whose real-world urgency is moderate, not critical. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H is internally consistent with the description: exploitation is LOCAL (AV:L) and requires some privilege (PR:L) because building the oversized information elements requires issuing a scheduled-scan request, which on Linux needs the CAP_NET_ADMIN capability - it is not remotely reachable by an unauthenticated network attacker despite the high impact triple (C:H/I:H/A:H reflecting kernel-space corruption). The exploitation-probability signals point AWAY from urgency: EPSS is only 0.21% (11th percentile), the CVE is NOT on CISA KEV, and no public exploit or PoC reference is present in the input - so the status is 'no public exploit identified at time of analysis.' The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a patchable local-privilege kernel bug rather than a widely-exploited remote flaw. One cross-signal nuance: the 'Information Disclosure' tag understates the issue - the fixed-buffer overflow with I:H/A:H indicates out-of-bounds write / memory corruption, not mere disclosure, but this is a labeling nuance rather than a conflict in the core signals. No SSVC exploitation/automatable/technical-impact decision points were supplied, so that framework cannot be independently applied. Net: a genuine fix-this-cycle kernel hardening issue, not a drop-everything emergency.

A local user (or a compromised process) holding CAP_NET_ADMIN on a Linux host with an Intel iwlwifi-mvm wireless adapter issues a scheduled-scan request carrying deliberately oversized information elements. Because the probe request was built before the iwl_mvm_scan_fits() length check, the oversized IEs are copied into the fixed-size preq buffer before validation, overflowing kernel memory and enabling corruption that can lead to privilege escalation or denial of service. No public exploit or PoC is identified in the available data.