From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E48FB3A3834 for ; Sun, 18 Oct 2026 15:48:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792338538; cv=none; b=ATIdTuc5M2WingrCZqNIRTn2cmxdGWEiB6gq0lWmUUBR58DoEU5ft7T5LWnSTU6KbHY2m+47+j2/UW81Z2f9q1zfKv+ssRs2dSB8So6tArEvbBRVbjoT9CUQsQDHw6mlnlxMoZt2kwCNR6TqR0eY7raN4v7NaY3QyEYztuuzgsg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792338538; c=relaxed/simple; bh=6HiJh+lMr90gNCbwe/m0ECdGo0WMNkBsjXj3J+hyNm4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=SGMub+y2+B+T2vLVTEt0tD6QHpSmkFChH5Ckm8x7vJ8odzkTYvKMqmdVA85GRKjoyK+3CVTlr/xKFj9SlvlcHN1+Uwau262yh7EUBa/WNER3RCkxcMwY4orGVHy83fMoSR3taOgRNdysS9+QR+SxtVEeU+8UMivTPALV7KFk8nk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=OFJ7KhNE; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="OFJ7KhNE" Received: by smtp.kernel.org (Postfix) with ESMTPSA id DD5B81F000C4; Sun, 18 Oct 2026 15:48:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1792338537; bh=6jeJNJLxM1q/8QdBahkECiQWaEZChrE8KVCbBBG5DBY=; h=From:To:Cc:Subject:Date:Reply-To; b=OFJ7KhNEgqeC1K9CWZ6Gtv7wFrwouLDmlgGwFvEYKSVjNrNW3jJnizdfGQkk3Wj/u tauzNSI1VzqqLbK/5N1SA8Cr8s1uzc0UlF1jbbXN1JjPsUJDfeDNpQghriGhwQYLlg 0LfW9Oi/C52OWirFrsKGNNtgQ0zkpW4weZVMUkvg= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-98658: iio: proximity: aw96103: validate firmware data length Date: Sun, 18 Oct 2026 17:43:53 +0200 Message-ID: <2026101854-CVE-2026-98658-e804@gregkh> X-Mailer: git-send-email 2.56.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2812; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=O0bIk58qgI44YZ9YghNviKoVpNS7O079QwvP9DFc08c=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlXXlq1P5+90/Vi2AELTpHMqnlHO5t/P9pte0ts6alQF keZYtVzHbEsDIJMDLJiiixftvEc3V9xSNHL0PY0zBxWJpAhDFycAjARiTcMC1r+Z+ZNM3Jvevdz /54QOeuIRav1VzMsaOM4fKbiZtHZtzblH5UCNz599YrjAwA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: iio: proximity: aw96103: validate firmware data length The firmware parser reads a length from the binary header and then uses it to walk six-byte register/value entries. A truncated firmware image can make the parser read beyond the copied firmware buffer. A value smaller than the four-byte count field also underflows, producing a very large length. Read the little-endian field with get_unaligned_le32(), as previously proposed by David Lechner. Validate the header size, reject an underflowed length, ensure the resulting payload is contained in the firmware image, and require it to contain whole register/value entries. The Linux kernel CVE team has assigned CVE-2026-98658 to this issue. Affected and fixed versions =========================== Issue introduced in 6.12 with commit 07b241262dcad07671c444ca955903325de28e9e and fixed in 6.12.113 with commit 4a9b9f2d4e26589afd0ac099c8e5593170dd5ac7 Issue introduced in 6.12 with commit 07b241262dcad07671c444ca955903325de28e9e and fixed in 6.18.56 with commit 6501b032be217ecf47e793b78a05078cf0b604ad Issue introduced in 6.12 with commit 07b241262dcad07671c444ca955903325de28e9e and fixed in 7.2.10 with commit 815ae0b73b69ace207b6bbf7ef428b06491c3ddb Issue introduced in 6.12 with commit 07b241262dcad07671c444ca955903325de28e9e and fixed in 7.3-rc6 with commit 1a7c522a35477d70320bd64aba8e9de0c1058c6f Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-98658 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/iio/proximity/aw96103.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/4a9b9f2d4e26589afd0ac099c8e5593170dd5ac7 https://git.kernel.org/stable/c/6501b032be217ecf47e793b78a05078cf0b604ad https://git.kernel.org/stable/c/815ae0b73b69ace207b6bbf7ef428b06491c3ddb https://git.kernel.org/stable/c/1a7c522a35477d70320bd64aba8e9de0c1058c6f